Home / Security Tools / Subdomain Discovery
Security Tools
Passive enumeration from CT logs and DNS data.
Subdomain Discovery passively enumerates the subdomains of a domain using public Certificate Transparency logs and passive DNS data — no active scanning of the target is performed.
Enter a domain name (example.org) and run the tool. The probe queries public CT logs and passive DNS sources for any subdomain recorded against the domain.
Input: Domain — e.g. example.org.
The output is a deduplicated list of discovered subdomains (dev., staging., api., mail., vpn.…). Use it to map your external attack surface or to find forgotten, exposed hosts. Because the source is passive public data, only subdomains that have appeared in a public certificate or DNS record will be found.
→ Map your external attack surface for a security audit.
→ Find forgotten or stale subdomains to decommission.
→ Discover subdomains created without change control.
→ Reconnaissance for an authorised penetration test.
No. Only subdomains that have appeared in a public Certificate Transparency log or passive DNS data are returned. Internal-only or never-certified subdomains that never resolved publicly will not appear. Treat the result as a lower bound of your external surface.
It only queries public databases and sends no traffic to the target, so it is non-intrusive. It is appropriate for mapping your own attack surface or for reconnaissance on assets you are authorised to assess.
It was likely created by a team member or automation and issued a certificate, or it is leftover from an old project. Investigate each unexpected result — forgotten hosts are a common source of unpatched, exposed services.