No recently used tools
Loading categories...
Free online subdomain finder that discovers all subdomains of any domain. Scans certificate transparency logs, DNS records, and multiple OSINT sources for complete subdomain enumeration. Ideal for penetration testing, bug bounty reconnaissance, and attack surface discovery. Instant results with source attribution. No signup required.
Discovers subdomains using certificate transparency logs, DNS records, and OSINT sources.
A subdomain finder is a tool that discovers all subdomains associated with a root domain. Subdomains are prefixes added to a domain name (e.g., mail.example.com, api.example.com, dev.example.com) that often host separate services, applications, or environments.
Subdomain discovery is a critical first step in penetration testing, bug bounty hunting, and attack surface management. Subdomains frequently expose:
Development and staging servers often run with weaker security configurations and default credentials.
Microservices and internal APIs may lack proper authentication or rate limiting when exposed.
Forgotten services running outdated, unpatched software are common attack vectors.
Management interfaces not intended for public access but discoverable via subdomain enumeration.
Follow these steps to discover subdomains using this free subdomain lookup tool:
Type the target domain (e.g., example.com) into the search field. Do not include the protocol or any path.
The tool queries certificate transparency logs and DNS data sources in parallel to enumerate subdomains.
Browse results organized by data source. Check the total count and look for staging, admin, API, and internal subdomains.
Copy or download results as CSV. Use discovered subdomains with DNS lookup, port scanners, or HTTP probers to identify live services.
Effective subdomain enumeration combines multiple techniques for maximum coverage:
| Method | How It Works | Strengths |
|---|---|---|
| Certificate Transparency | Queries public CT logs that record every SSL/TLS certificate issued. Subdomain names appear in the SAN field. | Discovers subdomains with SSL certs, including internal hosts |
| Passive DNS | Aggregates historical DNS resolution data collected by sensors worldwide. | Reveals subdomains that existed in the past, even if offline |
| DNS Brute-Force | Systematically resolves common subdomain names using wordlists against the target domain. | Finds subdomains without certificates or public references |
| Search Engine Dorking | Uses site:example.com operator to find indexed subdomains from crawlers. | Discovers web-facing subdomains with actual content |
| Web Archive Crawling | Searches historical snapshots for referenced subdomain URLs. | Uncovers decommissioned subdomains that may still resolve |
Subdomain discovery is one of the most important reconnaissance steps in any security assessment. Organizations often have hundreds of subdomains, many unmonitored:
When a subdomain points to a decommissioned cloud service (S3 bucket, Heroku app), attackers can claim that resource and serve malicious content under your domain.
Departments may create subdomains for internal projects without security review, leaving them vulnerable to exploitation.
Staging and development environments frequently use weaker passwords or expose debug endpoints with sensitive data.
PCI-DSS and SOC 2 require organizations to maintain an inventory of all internet-facing assets, including subdomains.