Security
Subdomain Finder
Discover subdomains of a domain by searching public Certificate Transparency logs for every certificate ever issued.
Most recent certificates:
| Common Name | Issuer | Valid From | Valid To |
|---|
CT logs are public and include old certs, so results are historical, not necessarily what's live now.
This search is sent to crt.sh, a public Certificate Transparency log search service.
Learn about Certificate Transparency subdomain searches
How this actually finds subdomains
Every publicly trusted TLS certificate gets logged in a public, append-only Certificate Transparency log, a requirement every major browser now enforces before it'll trust a certificate. Searching those logs at crt.sh for a domain surfaces every hostname that's ever had a certificate issued for it, which tends to be the most complete subdomain-discovery method available without scanning the target directly.
Reading your results
A listed subdomain only means a certificate was issued for it at some point. It doesn't mean the host is still active or currently live. Some results will be old, retired, or internal-only hosts that simply happened to get a certificate once.
Common questions
Why do I see subdomains I don't recognize? Wildcard certificates, staging or test environments, and services from years ago all show up too, since the log is permanent and doesn't get cleaned up as infrastructure changes over time.
Does a listed subdomain mean it's currently reachable? No. Check it separately with a DNS lookup or the Is It Down checker, since certificate history and live DNS are two different things.
Can this find subdomains that never got a TLS certificate? No. This method only surfaces hosts that had a publicly logged certificate at some point, so a subdomain that only ever ran on plain HTTP wouldn't show up here.