Subdomain finder
Host names seen in public certificate logs, with a check on which still resolve.
What this check does
Every publicly trusted certificate is logged. Searching the logs for a domain reveals the host names it has had certificates for, including forgotten test and staging hosts.
- Names from Certificate Transparency (crt.sh) with first-seen dates
- Wildcard certificates flagged
- Resolution check on the first names
- Stale names that no longer resolve (dangling-record risk)
Questions
- Is this every subdomain?
- No. Only names that appeared in a certificate. Internal names and hosts behind a wildcard do not show individually.