Subdomain Finder
Enumerate a domain's subdomains passively by mining public Certificate Transparency logs — no traffic is sent to the target, making it safe for external reconnaissance.
About the Subdomain Finder
Enumerate a domain's subdomains passively by mining public Certificate Transparency logs — no traffic is sent to the target, making it safe for external reconnaissance.
Queries run from our global edge network, so you see what a neutral observer on the public internet sees — not what your local network or ISP resolver happens to have cached.
Frequently asked questions
What does the Subdomain Finder do?
Enumerate a domain's subdomains passively by mining public Certificate Transparency logs — no traffic is sent to the target, making it safe for external reconnaissance.
Is the Subdomain Finder free to use?
Yes. The Subdomain Finder is completely free with no account, no signup and no usage limits for normal use.
Do you log the lookups I run?
No. Queries are processed at the edge and returned straight to you. We do not retain, profile or sell your lookup history.