Before auditing a domain's security, migrating services, or simply understanding a project's infrastructure (your own or a client's), it's worth knowing which subdomains actually exist: api., staging., admin., dev.... Many of them aren't linked from anywhere visible, so just browsing the site isn't enough to find them.
Why "guessing" subdomains isn't enough
The traditional brute-force method (trying admin.domain.com, test.domain.com, etc. against a list of common words) has two problems: it's slow, and it generates direct traffic against the target server, which in an unauthorized audit context can be problematic or simply undesirable. A passive alternative exists that doesn't send a single request to the domain you're investigating.
What Certificate Transparency is
For years, all certificate authorities have been required to publish a public log of every SSL certificate they issue, as a safeguard against fraudulent certificates. This system is called Certificate Transparency, and its public database (accessible, for example, at crt.sh) contains the exact domain names covered by every issued certificate, including subdomains.
Since any subdomain with HTTPS needs a certificate, and that certificate gets publicly logged the moment it's issued, searching Certificate Transparency reveals subdomains that existed or exist, without needing to touch the server at all.
How to discover a domain's subdomains
- Enter the main domain.
- The tool queries the Certificate Transparency log (crt.sh).
- Review the list of subdomains found from issued certificates.
You can do it free with the subdomain finder on this site, 100% passive, no active scanning against the domain.
Why this reveals things that shouldn't be public
It's common for subdomains from environments nobody meant to make public to show up in the results: staging., dev., internal., test-api.. This happens because, even though the subdomain itself isn't linked from any site or indexed by Google, the SSL certificate protecting it does get publicly logged by Certificate Transparency the moment it's issued. It's one of the most common ways "hidden" environments get discovered when they were never really fully hidden.
Difference from the web analyzer
This tool focuses specifically on passive subdomain reconnaissance via Certificate Transparency. If you need a full overview of a domain (DNS, WHOIS, SSL, SEO, email and tech stack in a single report), the web analyzer bundles this check together with the others in a single audit.
Frequently asked questions
Does this generate traffic against the target domain's server? No, the query is made against the public Certificate Transparency log, not against the domain itself.
Do I find every subdomain that exists? Only those that have had an SSL certificate issued at some point; subdomains without HTTPS or their own certificate won't show up this way.
Is this technique legal? Yes, querying a public log like Certificate Transparency requires no special authorization; it's public information by design.
Does it help find vulnerabilities? Not on its own; it identifies attack surface (which subdomains exist), which is the first step before any deeper security analysis.
Discover any domain's subdomains for free with the subdomain finder, via Certificate Transparency and with no active scanning.