Subdomain finder
Passive enumeration via certificate transparency logs — no brute force, no touch on target.
How this tool works
How many subdomains does a domain really have? Certificate transparency logs (CT logs) give a reliable answer. Every certificate issued by a public CA — Let's Encrypt, DigiCert, Sectigo, GlobalSign — is published in CT logs. We query three independent sources one after another: crt.sh and certspotter (sslmate) search the CT logs, the HackerTarget host search adds hostnames from its own records — if one is down, the others keep returning results. This makes subdomain enumeration fully passive: we do not touch your server, no brute force, no wordlist, no DNS queries against your nameserver. Results include subdomains that were ever certified or recorded by HackerTarget — even if no longer active.
Typical use cases
- Inventory your own domains — sometimes you forget dev.staging.api.foo.invalid
- Before an SSL audit, identify the complete portfolio
- After M&A: which subdomains does the acquired company have?
- For trademark protection, check whether third parties certified subdomains on your domain
Frequently asked questions
Why is this passive, not "recon"?
CT logs are a public, transparent database published as a browser/CA standard. We only read there, without contacting the target host. Anyone can do this.
Why do subdomains appear that no longer exist?
CT logs contain EVERY certificate ever issued. If staging.example.com had a cert 3 years ago and was shut down, it still shows up here.
Why not wordlist brute force?
Brute force is legally sensitive (can be classed as an intrusion attempt) and standard wordlists mostly find what CT logs already have. CT is cleaner and more complete.
Which sources are queried?
Three independent sources one after another: crt.sh (classic CT search), certspotter from sslmate.com and the HackerTarget host search. The tool stays functional even if one source is down or rate-limited. Response includes "sources_used"/"sources_failed" for transparency.
Why is a subdomain I know missing?
If the subdomain never had a public certificate (internal service on internal CA, no TLS, or self-signed), it does not appear in CT.
Are results cached?
Yes, 1 hour per domain — CT sources can be slow, the cache saves 10-15 seconds on repeated queries.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.