Subdomain Finder
Find subdomains by searching public Certificate Transparency logs. Results include all subdomains that have ever had an HTTPS certificate issued.
Source: Certificate Transparency (certspotter.com) - 1 certificates scanned. Results include historical subdomains that may no longer be active.
Related Tools
Query A, AAAA, MX, TXT, CNAME, NS, SOA, CAA records.
Domain registrar, expiry date and nameservers.
Check when a domain was registered, when it expires, and who the registrar is.
About this tool
Certificate Transparency (CT) is a public, append-only ledger of every TLS/SSL certificate ever issued by participating Certificate Authorities. Since certificates include the domain names they cover, CT logs are a comprehensive source of subdomain enumeration - no active scanning required. This tool queries the Certificate Transparency database via CertSpotter, which indexes CT logs from all major CAs including Let's Encrypt, DigiCert, and Sectigo.
Results include subdomains that are no longer active, wildcard certificates are excluded (a cert for *.example.com does not reveal specific subdomains), and subdomains only reachable over HTTP (no HTTPS) will not appear. Results are based on the most recent 1,000 certificates and are cached for 1 hour.
