What is a subdomain finder?
A subdomain finder discovers the subdomains that belong to a root domain — names like mail.example.com, vpn.example.com or staging.example.com. Mapping these is a core step in reconnaissance, because each subdomain is a potential entry point and together they describe an organisation's public attack surface.
This tool uses passive enumeration via Certificate Transparency (CT) logs rather than noisy brute-force scanning. Every time a site obtains an SSL certificate, the hostname is recorded in public CT logs. By querying sources like crt.sh and Cert Spotter, we can list subdomains that have ever had a certificate — quietly, without sending a single packet to the target.
Why Certificate Transparency works so well
Certificate Transparency was introduced to detect mis-issued certificates, but it has become one of the most reliable OSINT sources for subdomain discovery. Because virtually every public HTTPS site needs a certificate, and every certificate is logged, CT logs capture subdomains that wordlist-based scanners would miss — including short-lived staging and admin hosts.
Passive discovery is also stealthy and legal: you are reading public logs, not probing the target's servers. That makes it ideal for early-stage reconnaissance, bug-bounty scoping and attack-surface monitoring.
Using the results responsibly
The output is a deduplicated, sorted list of subdomains with quick links to visit each one. Use it to understand how an organisation is structured, to find forgotten or development hosts, and to monitor for new infrastructure over time.
Only test systems you own or are explicitly authorised to assess. Discovering a subdomain is passive and harmless, but actively scanning or attacking it without permission may be illegal.