Subdomain finder
Every certificate ever issued for your domain is published in public logs - attackers read them to find forgotten test servers and admin panels. See what they see, and whether any subdomain can be taken over.
Reads only public data. Results are not stored.
What this tool checks
We collect host names from Certificate Transparency logs and common names, resolve them in DNS, and flag aliases that point to deleted cloud resources (takeover risk) and hosts that look like development or administration systems. Only public logs and DNS are queried; the hosts themselves are not contacted.
Questions
What is a subdomain takeover?
A subdomain still points (CNAME) to a cloud resource - a GitHub Pages site, a Heroku app, an S3 bucket - that was deleted. Anyone who creates a resource with that name serves their content under your domain.
Why are old test hosts a risk?
Development, staging and admin systems are usually less patched and protected than production, and often hold real data. Restrict them to a VPN or remove their DNS records.
Does it find every subdomain?
It finds every name that appears in a public certificate plus common names that resolve. Hosts that never had a certificate and use unusual names can stay hidden.