Home / Tools / Subdomain lookup
Subdomain lookup
Find subdomain names observed in public certificate transparency records.
How it works & common questions
Where does the data come from?
Public certificate transparency records from crt.sh. Names are extracted from certificate records without actively scanning the target. Successful results may be cached for one hour. Errors and rate limits are reported with a link to the original records.
Are results complete or currently active?
Not necessarily. Names without public certificates may be absent; historical names may be inactive. A wildcard is not proof of a live host. Results show up to 500 unique names.