• Network & DNS

Subdomain Finder

Discover publicly known subdomains for any domain using certificate transparency logs and passive DNS.

Target URL

Domain or URL only — e.g. example.com or https://example.com/page → checks example.com

• About this tool

What is Subdomain Finder?

Find publicly known subdomains for any domain using certificate transparency logs and passive DNS data. Ideal for attack surface mapping.

subdomain findersubdomain enumerationsubdomain discoveryattack surface mappingsubdomain scanner

• FAQ

This tool queries certificate transparency logs (e.g. crt.sh) and passive DNS databases that index publicly observed DNS records.

Only publicly observed subdomains are returned. Internal or recently created subdomains may not appear.

Forgotten or unmanaged subdomains are common attack vectors — they may run outdated software or have misconfigured access controls.

Querying public certificate transparency logs and passive DNS is legal. Active brute-force enumeration against a target you do not own may not be.

• Related

DNS Lookup Tool

Query all DNS record types (A, AAAA, MX, TXT, NS, CNAME, SOA) for any domain.

IP Lookup Tool

Look up geolocation, ISP, and ASN for any IPv4 or IPv6 address.

SSL Certificate Checker

Inspect the SSL/TLS certificate for any domain. Check validity, expiry, issuer, and certificate chain.

• automated security

PandaONE runs autonomous agents against your app, validates findings with proof, and opens fixes as pull requests.