Subdomain Finder
Discover subdomains of any domain using public certificate transparency logs.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
Every publicly trusted SSL certificate ever issued is logged in public Certificate Transparency logs. This tool searches those logs for any certificate that includes your domain, revealing subdomains that were never meant to be publicly known.
Forgotten staging servers, old admin panels, and test environments often surface this way — subdomains that were never linked from anywhere but still got an SSL certificate at some point, and are still sitting there reachable.
Frequently asked questions
Why does this find subdomains that don't show up in my DNS panel?
It searches certificate transparency logs, which record every publicly-trusted SSL certificate ever issued — including for subdomains that were later deleted or repointed, so it can surface forgotten ones your current DNS panel doesn't show.
Is finding a subdomain the same as it being vulnerable?
No — most found subdomains are perfectly normal and in active use. The follow-up step is checking any unfamiliar ones with the Subdomain Takeover Checker to see if they're dangling and exploitable.
Related tools