Subdomain Finder
List the subdomains of a domain found in certificate transparency logs, deduplicated, with the first 25 resolved to IPs.
Find subdomains
From the certificate transparency logs via crt.sh. Large domains can take ten seconds or more.
What the Subdomain Finder does
Subdomain Finder lists the host names under a domain that have ever appeared in a public TLS certificate. Every certificate authority now logs the certificates it issues to certificate transparency logs, and crt.sh indexes those logs; querying it for %.yourdomain returns every name a certificate was issued for, including hosts that were never linked from anywhere.
The tool fetches that list, splits multi-name certificates into single hosts, drops wildcards, removes duplicates and sorts the result with short names first. It then resolves the first 25 to IPv4 addresses (or the CNAME they point at) so you can tell at a glance which hosts are still live and which are leftovers from old projects. Up to 500 names are shown with the date each was last seen on a certificate.
Use it for a site audit, to find staging and test hosts that leak into search results, to inventory a client's infrastructure before a migration, or to check what a competitor has published. Only names that had a certificate appear; HTTP-only hosts and internal names that never got a public certificate stay invisible.
Step by step
- 01Enter the registrable domain, such as example.com, not a subdomain.
- 02Press Find. crt.sh is queried live and can take ten seconds or more for large domains.
- 03Scan the list: hosts with an address or a CNAME are live, those without resolve to nothing today.
- 04Check live hosts you did not expect with the SSL Certificate Checker and the Meta Tag Analyzer, and add noindex or remove them.
Common questions
Certificate logs are append-only, so a host that had a certificate three years ago is still recorded. That is useful for an audit (it shows you what was once public) but it means the list is a history, not a current inventory. The resolved IP column separates the two for the first 25 names.
crt.sh is a free service run by Sectigo and it is often slow or briefly unavailable, especially for domains with thousands of certificates. The tool waits fifteen seconds. Wait a minute and try again; for very large domains, results may simply be too big for the service to return in time.
No tool can. This one finds only hosts that have had a publicly logged certificate, which covers almost every modern HTTPS host but not plain HTTP hosts, names behind a wildcard certificate (the wildcard itself is shown as a count) or internal names. Combine it with DNS records, your hosting panel and a crawl for a fuller picture.
Certificate transparency logs are public by design; reading them is no different from reading a certificate in your browser. Scanning or probing the hosts you find is a different matter, so limit yourself to looking at what is publicly served.
Keep checking
DNS Lookup
Look up the A, AAAA, CNAME, MX, NS, TXT, SOA, SRV and CAA records of any domain with their TTLs in one query.
Free toolSSL Certificate Checker
Check a site's TLS certificate: issuer, expiry and days left, SANs, chain, protocol and whether the host name matches.
Free toolDomain to IP
Find the IPv4 and IPv6 addresses behind a domain, the reverse DNS name of each and a hint at the hosting provider.
Free toolWHOIS Lookup
Registrar, creation and expiry dates, name servers, status and DNSSEC for a domain, or the network owner of an IP.
Free toolBroken Links Checker
Test up to 50 links on a page and list the broken, redirected and working ones with their HTTP status.
Want these fixes done for you?
Our team runs the audit, makes the changes and reports the result.