A free passive subdomain enumeration tool
Subdomain discovery is the first step of almost every security assessment and bug-bounty engagement.
Each subdomain — api., staging.,
vpn., admin. — is another door into an
organisation, and forgotten or misconfigured hosts are where breaches start. This subdomain finder helps you
map that attack surface quickly, using only public data, so you can see what an attacker would see before they do.
Unlike brute-force scanners that hammer a target with thousands of DNS queries, this tool stays passive: it reads Certificate Transparency logs and public DNS to enumerate subdomains without ever touching the target’s infrastructure. Every result is enriched with its resolved IP address and a Cloudflare flag, and you can sort, filter, and export the full list to CSV or JSON. Need to confirm which hosts are actually live? Opt in to the authorised active liveness check — strictly for domains you own or are permitted to test.
How the subdomain finder discovers hosts
Behind the scenes the tool pulls from several independent datasets and merges them into a single, de-duplicated list.
It queries Certificate Transparency logs through crt.sh and certspotter — public, append-only records of
every TLS certificate issued — which routinely expose internal-sounding hosts that were never meant to be advertised.
It cross-references a passive-DNS source for names that have resolved historically, and it resolves a
curated common-subdomain wordlist (think mail,
dev, portal,
cpanel) over DNS-over-HTTPS. Each candidate is then resolved to an IP address,
and every IP is matched against Cloudflare’s published ranges so you instantly see which hosts sit behind a CDN and which
expose their origin directly.
A privacy-first DNSDumpster alternative
If you have used DNSDumpster or similar public scanners for domain reconnaissance, this subdomain finder covers the same core job — turning a single root domain into a map of its subdomains and hosts — with a deliberately different emphasis. Where many public scanners archive and index every lookup (so your target domains become searchable by anyone), this tool processes each scan in real time and never stores, logs, or publishes what you search. You also get multi-source Certificate Transparency coverage combined with a DNS wordlist in one pass, an IP and Cloudflare flag on every row, and clean CSV/JSON export — with no account, no API key, and no rate-limited signup wall. It is a fast, no-friction DNSDumpster alternative for anyone who wants OSINT reconnaissance without handing their search history to a third party.
Who uses a subdomain finder, and why
Penetration testers use it to scope an engagement and surface shadow IT before active testing begins.
Bug-bounty hunters lean on passive enumeration to find in-scope assets that the wider field has missed —
the forgotten staging. box is often where the highest-severity findings live.
Blue teams and IT admins run it against their own domains to keep an honest asset inventory and catch
dangling DNS records that invite subdomain takeover. And teams doing M&A or vendor due diligence use it
to gauge an organisation’s external footprint at a glance. In every case the value is the same: you cannot defend, or
attack, what you have not yet discovered.
Find subdomains responsibly
Passive enumeration from public CT and DNS data is a standard, generally legal part of security research — you are reading information that organisations have already published. The optional live status check is different: it sends a real request to a host, so it is opt-in and gated behind an explicit authorisation confirmation. Only enable it against domains you own or have written permission to test. Built and maintained by the team behind HackproofHacks’ penetration testing services and ethical hacking training.