Subdomain Finder
Discover active subdomains using public SSL Certificate Transparency records
Certificate Transparency Subdomain Finder
Discover all public subdomains registered in SSL/TLS Certificate Transparency logs without port scanning
Want even better results?
Get access to advanced tools and grow your traffic faster.
What is Certificate Transparency Subdomain Finder?
Discover all active and historical subdomains for any website using public SSL/TLS Certificate Transparency logs.
The Subdomain Finder leverages public Certificate Transparency cryptographic registries and DNS-over-HTTPS enumeration to map out your domain’s attack surface and discover subdomains without intrusive network brute-forcing.
How to Use
Enter your root domain (e.g. example.com).
Click "Discover Subdomains".
Inspect the complete list of unique subdomains found in CT logs.
Review the issuing Certificate Authority and logged dates.
Why Use This Tool?
Discover forgotten staging, dev, and admin subdomains
100% passive scan with zero origin IP exposure or port scanning
Inspect certificate issuers and validity periods
Prevent subdomain takeover vulnerabilities