Subdomain Finder

Find the subdomains of any domain from public SSL certificate transparency logs — passive and safe.

How do I find all subdomains of a domain?

Enter the domain and the tool searches public Certificate Transparency logs — where every trusted HTTPS certificate is recorded — for names ending in that domain, listing each subdomain with the dates of its first and latest certificates. Nothing is scanned or probed.

Uses

Auditing your own attack surface: forgotten staging, test or admin hosts.
Finding subdomains to include in an SEO or migration audit.
Checking which certificates have been issued for your brand.

Subdomains without HTTPS certificates will not appear.

Frequently asked questions

Is this legal?

Yes — CT logs are public by design.

Why are some subdomains old?

Logs keep history; a listed name may no longer exist.

Where does the data come from?

crt.sh, with Cert Spotter as a fallback, cached for 24 hours.