Subdomain Finder

About Subdomain Finder

This tool finds subdomains by querying certificate transparency logs at crt.sh, which records every TLS certificate issued by every public CA. Any subdomain that has ever held a cert appears in the result. For each discovered subdomain (capped at 30 active probes per run for speed), the tool resolves the current IP, looks up the ASN via RIPE stat, identifies the CDN vendor if any, and cross-references the network operator against our datacenter directory to surface the facility provider where possible.

When to use it

Run this during a security assessment to map a target's externally visible attack surface. Use it during competitor research to see which subdomains they expose for marketing landing pages, staging environments, or APIs. Sysadmins use it after a migration to confirm every active subdomain points at the new infrastructure and none still point at the old origin.

How to read the results

Total found is the count from CT logs, which can include historical subdomains that no longer resolve. The probed rows show current state: IP, ASN, holder, and detected CDN. The Datacenter column links to our internal datacenter directory when the AS holder matches an operator in our directory, which often reveals the physical facility where traffic terminates. Empty CDN cells mean the subdomain is served direct from origin or uses a non-standard CDN.

Frequently asked questions