Domains & DNS
Subdomain Finder
Discover a domain’s subdomains from public certificate-transparency logs. A fast subdomain finder for security research, migrations and site audits.
Need reliable hosting, a domain, or a hand setting this up?
Get a free quote →About the Subdomain Finder
The Subdomain Finder discovers subdomains associated with a domain by mining public certificate-transparency logs, the same records generated every time an SSL certificate is issued. This surfaces hosts like mail, staging, api, dev or admin that may not be obvious from the main website. It is a valuable first step for security researchers mapping an attack surface, teams planning a migration who need a complete inventory, and administrators auditing what is publicly exposed.
This free tool by Hosting Cambodia serves developers, penetration testers, and web professionals in Cambodia and internationally who need fast, passive reconnaissance without touching the target's servers. Enter a root domain and receive a list of subdomains found in certificate logs, helping you catch forgotten test environments, verify your own exposure, or build a thorough site map before a project.
Frequently asked questions
How does the Subdomain Finder discover subdomains?
It searches public certificate-transparency logs, which record every SSL/TLS certificate issued, and extracts the domain names those certificates cover. This is a passive method that does not scan or contact the target servers.
Will it find every subdomain that exists?
No. It only finds subdomains that have had a public certificate issued, so internal hosts or subdomains without certificates may not appear. It is thorough but not exhaustive.
Is using the Subdomain Finder legal?
Yes, because it only reads publicly available certificate-transparency data and does not probe or attack the target. Always ensure any follow-up testing has proper authorisation.
Explore the full free web tools toolbox by Hosting Cambodia.