Free Subdomain Finder — Discover Subdomains Online
Discover subdomains using Certificate Transparency logs
Frequently Asked Questions
How does the subdomain finder work?
It queries Certificate Transparency (CT) logs — public records of all SSL certificates issued. Any subdomain with an SSL certificate will appear in CT logs.
Why is subdomain discovery important for security?
Forgotten subdomains (dev, staging, old APIs) are common attack targets. They often run outdated software, have weaker security, or expose internal services.
Can it find all subdomains?
It finds subdomains with SSL certificates in CT logs. Subdomains without certificates or using wildcard certs may not appear. For comprehensive discovery, combine with DNS brute-forcing.
Is subdomain enumeration legal?
Querying public CT logs is legal. The data is intentionally public. Using discovered subdomains for unauthorized access is illegal.
For authorized, legal, and ethical security testing only. Scans are rate-limited to 3 per day on the free tier.