← ALL TOOLS
// RECON & INTEL · SERVER

Subdomain Finder

Enumerate subdomains from certificate transparency logs and a top-500 DNS wordlist. Only for domains you may test.

RECON · SERVER-SIDE · RATE LIMIT 4/MIN

Only scan systems you own or are authorised to test. Each run is logged with your IP address.

Rate limited: 2 runs in a burst, 4 per minute. Results are never stored. Too long to share as a link.

HISTORY

Your last 5 runs appear here for 7 days, on this device only.

RESULT

Fill in the form and run the tool; the result appears here.

Subdomain Finder enumerates subdomains of a domain by combining certificate transparency logs (crt.sh) with a DNS brute force of 500 common names, and lists the names that resolve to an IPv4 address. Only run it against domains you own or are authorised to test.

How to read the result

Each row lists a discovered name and the addresses it resolves to. The summary line says which sources answered for this run (certificate transparency, the DNS wordlist, or both) and marks the list as truncated when the 20-second time limit or a size cap cut it short, so more may exist than shown.

Names found in certificates that no longer resolve are left out. If the zone answers any name (wildcard DNS), wordlist hits that only echo the wildcard are dropped, and the result says so.

Defender tips

  • Monitor certificate transparency logs for new certificates issued on your domains; it is often the first sign of a subdomain you did not know was provisioned.
  • Decommission DNS records for services you have torn down. A CNAME still pointing at a deprovisioned cloud resource is exactly what subdomain takeover attacks look for.
  • Avoid wildcard certificates where a scoped certificate would do; a wildcard certificate covers every subdomain an attacker might later stand up.

FAQ

Why does this require a checkbox before running?

Subdomain enumeration sends hundreds of DNS queries and can resemble reconnaissance against infrastructure you do not control. The checkbox, asked once per browser session, confirms you own the domain or are authorised to test it, and every run is logged with your IP address and the domain.

Why does certificate transparency find names brute force does not?

Publicly trusted TLS certificates are recorded in certificate transparency logs, including those for names nobody would guess from a wordlist, such as long internal-sounding hostnames.

Does a listed subdomain mean it is vulnerable?

No. It only means the name exists and resolves. Whether it is exposed to anything is a separate question, and is exactly what the other recon tools on this page help you check next.