Subdomain Finder

Find every subdomain of a domain in about a second, from the public record of TLS certificates.

Every certificate issued by a public authority is written to open logs, and those logs name the hostnames each certificate covers. Reading them reveals a domain's subdomains without sending a single request to the domain itself.

How to use it

1. Put your domains into Domains, one per line.
2. Run the Actor.

Full URLs are fine — https://www.example.com/pricing is read as example.com. If you enter something below the main domain, such as gist.github.com, it is corrected up to github.com automatically and looked up there.

What you get

For every subdomain found:

• The full hostname
• The prefix in front of the main domain, on its own
• How many levels deep it sits
• Whether it is the main domain itself
• Whether it is a wildcard entry

Turn on One row per domain to get a single row per domain holding the entire list instead. For a domain with tens of thousands of subdomains that is far quicker to write and easier to hand to another tool.

What you can do with it

• Map your own attack surface, including the hosts nobody remembered were there
• Find staging, development and admin hosts that were never meant to be public
• Check what a supplier or acquisition target exposes before signing
• Watch a domain over time by running on a schedule and comparing runs
• Feed the list into a port scanner, screenshotter or vulnerability checker

Speed

One lookup answers a whole domain, so the lookups themselves are close to instant — six domains holding 77,000 subdomains between them were fetched in about a second in testing.

What actually takes time is writing the results. The same 77,000 subdomains took 25 seconds to write as one row each, and 1.5 seconds written as one row per domain. If you are working at that scale, turn on One row per domain.

If you are collecting from many domains at once, raise Domains at a time. Ten is the default and works well; much higher rarely helps.

Good to know

Very large domains — the likes of google.com — hold more certificates than this service will return in one response, and are reported as such in the log rather than failing the run. Looking up their individual subdomains works instead.

A domain with no certificates on record returns nothing. That is a real answer, not an error: it means nothing has been publicly issued for it.

Certificate logs show what certificates were issued for, which is not the same as what is running today. Some hosts will have been retired, and any host that never had a public certificate will not appear at all.

Is this legal?

Certificate transparency logs are public by design — they exist so anyone can audit what certificates have been issued. This Actor only reads those published logs and never contacts the domains it reports on. Use it on domains you own or are authorised to assess.

SEO Keywords

subdomain finder, subdomain enumeration, certificate transparency logs, passive dns recon, attack surface discovery, osint subdomain tool, domain reconnaissance, ct log search, security asset discovery, find subdomains of a domain