Subdomain Finder
Enter an apex domain (e.g. namecheap.com) and this tool scans certificate transparency logs to list every public subdomain it has ever been issued for. Results are deduplicated, include first-seen dates when enabled, and can be exported as CSV or TXT for further analysis.
Использование Subdomain Finder
| Поддомен | Впервые замечено |
|---|
Прочитать текст
How to Use This Tool
Type the apex domain you want to investigate in the search box (for example namecheap.com) and click Find subdomains. The tool queries certificate transparency logs and returns every unique subdomain it finds.
1. Enter the apex domain
Use the registrable domain only — no protocol, no path, no subdomain. example.com is valid; www.example.com and https://example.com are not.
2. Review the results
Results appear in a table sorted alphabetically, with a copy button on every row. The summary cards show total subdomains, the data source, the remaining daily quota, and the response time.
3. Export
Click CSV or TXT to download the full result set. When the first-seen dates option is enabled, the CSV export includes them as an extra column.
Why Subdomain Discovery Matters
- Security audits — find forgotten or exposed subdomains before attackers do
- Asset inventory — map the full DNS footprint of any organization
- Attack surface review — identify staging, test and internal-looking hosts
Frequently Asked Questions
What is an apex domain?
The apex domain is the bare registrable domain without any subdomain prefix, such as namecheap.com. This tool accepts eTLD+1 domains only.
Where does the data come from?
Subdomains are discovered from certificate transparency logs. Any subdomain that has ever received a publicly logged TLS certificate appears in the results.
Does the tool include wildcard certificates?
Yes. Wildcard entries such as *.example.com are normalized to example.com and included in the result set.
Is there a rate limit?
The primary source allows 1,000 lookups per day. The tool caches results for 24 hours, so repeat lookups of the same domain never count against the quota. When the primary source is exhausted it automatically falls back to other certificate transparency sources.
Can I find subdomains of any domain?
You can query any public domain. Results only include subdomains that appear in publicly logged certificates — private or internal hosts will not be listed.
Комментарии (0)
Опишите возникшую проблему, чтобы мы могли её изучить и усовершенствовать инструмент.