Reading the result
What each status means
Every name is looked up in public DNS at the moment you search, so the list shows today's picture.
| Status | It means |
|---|---|
| Live | The name has a public address and can be reached from the internet. |
| Private address | The name is published, but points to an internal address. It can't be reached, yet it tells anyone your internal layout. |
| Gone | The name no longer exists in DNS. Only its certificate history remains. |
| DNS didn't answer | The lookup failed this time. Try again later. |
| Looks like | A reading of the name only (remote access, admin, files, test). Confirm what each host actually runs. |
How it’s checked
Public information only, nothing stored
Names come from public Certificate Transparency logs, searched through crt.sh and Cert Spotter. Each name is then looked up in public DNS through DNS-over-HTTPS. No host of the domain is contacted and no names are guessed or brute-forced.
A wildcard certificate (*.example.com) covers names without listing them, so hosts that only use one can't appear here; the result says when that's the case. The result is kept in memory for six hours, because the logs change slowly and are slow to search, and then discarded. Nothing is stored or linked to you.
Privacy policyQuestions
Subdomain finder FAQ
How do I find all subdomains of a domain?
Enter the domain above. We read every name under it from public Certificate Transparency logs, where every trusted certificate is recorded, then check which names are live in DNS today.
Is this a subdomain scanner?
It's passive subdomain enumeration: it reads public certificate logs and public DNS, so nothing is scanned, guessed or brute-forced and the domain never sees a request from us. Active subdomain scanners also try lists of common names against DNS, which finds a few more but is noisier and slower.
Why do subdomains matter for security?
Each live subdomain is a door into the organisation. Forgotten test sites, old remote access portals and admin panels are where attackers start, because they're often unpatched and nobody is watching them.
Why is a subdomain I know about missing?
It may only use a wildcard certificate, which covers it without naming it, or it may never have had a public certificate (for example, an internal-only name). Names that never had a public certificate don't appear in the logs.
Is it legal to look up another company's subdomains?
The logs are public by design, so anyone can read them. This tool only reads those logs and public DNS; it doesn't connect to or test any of the hosts it finds.
What is Certificate Transparency?
A public record of every certificate browsers trust. Authorities must log each certificate they issue, so site owners can spot certificates issued without their knowledge. The same logs list every name those certificates cover.
How do I remove a subdomain from the list?
You can't remove a name from the certificate logs; they're permanent. Take the host offline and delete its DNS record, and it will show as gone.