Free Subdomain Finder
Discover subdomains using certificate transparency logs
Enter any domain to discover its subdomains by querying certificate transparency (CT) logs. CT logs are public records of every SSL/TLS certificate ever issued, making them one of the most reliable sources for passive subdomain enumeration — no scanning or brute-forcing required.
Trusted by teams at
How it works
How Subdomain Finder works
Enter a domain
Type or paste any domain name. We strip protocols and paths automatically so you can paste full URLs too.
Query certificate transparency logs
We query public CT log databases for every SSL/TLS certificate ever issued for your domain, extracting all unique hostnames from the certificate common names and SANs.
Review discovered subdomains
Get a deduplicated, organized list of all subdomains found along with analysis of what the naming patterns suggest about the target's infrastructure.
Features
What Subdomain Finder checks
Passive enumeration via CT logs
Discovers subdomains by querying public certificate transparency logs — no active scanning, brute-forcing, or DNS queries against the target are needed.
Deduplicated and sorted results
Automatically removes duplicate entries and wildcard certificates, giving you a clean list of unique subdomains ready for further investigation.
Infrastructure pattern analysis
Identifies common patterns in subdomain names like staging environments, internal tools, API endpoints, and development servers that may reveal attack surface.
Wildcard certificate detection
Flags wildcard certificates (*.example.com) separately, which indicate the domain may have many more subdomains than those explicitly listed in CT logs.
Use cases
Who should use the free Subdomain Finder
Penetration Testers
Map out the full attack surface of a target during reconnaissance. Discover forgotten staging servers, internal tools, and API endpoints that may have weaker security controls.
Security Teams
Monitor your organization's subdomain footprint to identify shadow IT, unauthorized services, and forgotten assets that expand your attack surface.
Bug Bounty Hunters
Quickly enumerate all known subdomains in a bug bounty scope to find less-tested assets where vulnerabilities are more likely to exist.
More tools
All free security tools
Scanners
(10)Checkers
(6)Decoders & Generators
(3)FAQ
Frequently asked questions
Everything you need to know about the free Subdomain Finder.
Go beyond Subdomain Finder
This free Subdomain Finder checks a handful of things. Maced's AI pentest checks thousands.
Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.
Proof of exploit on every finding · SOC 2 & ISO 27001 compatible