Subdomain Finder
A subdomain finder discovers hostnames beneath a root domain by querying certificate transparency logs, passive DNS and OSINT sources, and resolving DNS records — revealing external attack surface without active brute force when using passive enumeration methods.
Enter a root domain (e.g., example.com) and click Scan. ScanSuite queries crt.sh for certificate transparency entries, runs Subfinder passive enumeration, merges results, and resolves A, AAAA, and CNAME records. The free tier discovers up to 50 subdomains using passive sources only — no brute force, HTTP probing, or takeover detection.
Introduction to Subdomain Discovery
Subdomain enumeration maps the hostnames associated with a root domain — revealing web applications, staging environments, mail servers, CDNs, and forgotten services that expand an organization's attack surface. Security teams, penetration testers, and asset owners use subdomain discovery to find shadow IT, validate DNS hygiene, and prioritize external exposure before adversaries do.
ScanSuite's free subdomain finder combines certificate transparency search (crt.sh), Subfinder passive source aggregation, and DNS resolution in a browser-based workflow. The free PUBLIC_FREE policy uses passive discovery only — no wordlist brute force, permutations, HTTP probing, or subdomain takeover checks. Premium ScanSuite unlocks active enumeration, live web service detection, port scanning on discovered hosts, takeover risk assessment, and continuous monitoring.
What Is a Subdomain Finder?
A subdomain finder collects hostnames that share a common root domain — such as api.example.com, staging.example.com, and mail.example.com under example.com. Discovery methods range from passive (querying public logs and archives without sending traffic to the target) to active (brute forcing wordlists against DNS resolvers). Certificate Transparency (CT) logs record every publicly trusted TLS certificate, making crt.sh an effective passive source because certificate SAN fields often list subdomains never advertised elsewhere.
Subfinder aggregates dozens of passive sources including DNS archives, search engine results, and threat intelligence feeds. DNS resolution confirms which discovered names currently resolve to IP addresses or canonical CNAME targets. An online subdomain finder runs these steps from cloud infrastructure and produces structured, shareable reports — eliminating local tool installation and manual result merging.
Why Use an Online Subdomain Finder?
External asset inventory is foundational to attack surface management. Developers spin up staging subdomains, marketing teams deploy campaign microsites, and acquired companies bring legacy DNS records — all creating hostnames security teams may not track centrally. Passive subdomain discovery surfaces these names without the noise and legal sensitivity of aggressive brute force against third-party infrastructure.
Browser-based enumeration removes friction on locked-down workstations and enables quick checks during incident response, M&A due diligence, and bug bounty reconnaissance. Combine results with our DNS lookup tool for detailed record inspection, port scanner for service discovery on resolved IPs, and SSL checker for certificate validation on HTTPS endpoints found during Premium HTTP probing.
Who Uses Subdomain Discovery Tools?
Bug bounty hunters and penetration testers map authorized target scope during reconnaissance phases aligned with MITRE ATT&CK T1590 (Gather Victim Network Information). Security engineers maintain external asset inventories for SOC 2, ISO 27001, and PCI-DSS evidence. DevOps teams verify that decommissioned services no longer appear in certificate logs or passive sources.
Red teams identify forgotten admin panels and dev environments exposed to the internet. Students learning OSINT and reconnaissance practice interpreting passive versus active discovery tradeoffs. ScanSuite serves each audience with a free passive tier and Premium capabilities for comprehensive enterprise attack surface management.
How the Subdomain Finder Works
When you submit a root domain, ScanSuite validates the input, queues a discovery job, and executes the PUBLIC_FREE policy: certificate transparency lookup via crt.sh, Subfinder passive enumeration, merge and deduplication of findings, then DNS resolution for each unique subdomain. Discovery events stream to your browser as a live feed showing sources queried and hostnames found.
Each subdomain is classified by resolution status — whether A, AAAA, or CNAME records exist. The free tier caps results at 50 subdomains per scan. Completed scans produce a structured report with discovered, resolved, and active HTTP counts plus a shareable public URL valid for 24 hours. Premium adds brute force wordlists, permutation engines, HTTP service probing, port scanning, takeover detection, unlimited results, and scheduled monitoring.
Example: Asset inventory for a corporate domain
Scanning example.com might reveal www.example.com, api.example.com, staging.example.com, and mail.example.com from certificate transparency and Subfinder. DNS resolution confirms which names currently resolve — staging.example.com may appear in CT logs but fail resolution if the environment was decommissioned.
Example: Post-acquisition DNS audit
After acquiring a company, passive subdomain discovery on their apex domain surfaces legacy hostnames like old-vpn.example.com or beta.example.com. Cross-referencing resolved IPs with the port scanner identifies services still reachable from the internet requiring migration or shutdown.
Passive vs Active Subdomain Discovery
| Method | Free Tier | Premium | |
|---|---|---|---|
| crt.sh CT logs | Included | Included | |
| Subfinder passive | Included | Included | |
| DNS resolution | Included | Included | |
| Wordlist brute force | Not included | Included | |
| Permutations | Not included | Included | |
| HTTP probing | Not included | Included |
Online Finder vs Local Subfinder
| Feature | ScanSuite Online | Local Subfinder CLI | |
|---|---|---|---|
| Installation | None — browser only | Local install + API keys | |
| Source merging | Automatic server-side | Manual aggregation | |
| DNS resolution | Built-in | Requires separate tooling | |
| Reporting | Shareable web reports | Text/JSON files locally | |
| Brute force | Premium only | Requires additional tools |
Free vs Premium Subdomain Discovery
| Capability | Free Tier | Premium | |
|---|---|---|---|
| Discovery sources | crt.sh + Subfinder + DNS | All sources + brute force | |
| Max results | 50 subdomains | Unlimited | |
| HTTP probing | Not included | Included | |
| Takeover detection | Not included | Included | |
| Monitoring | Not included | Scheduled scans + alerts | |
| Reports | Public link, 24 hours | Private encrypted, permanent |
Subdomain Finder Troubleshooting
If the scan fails to start, verify you entered a valid root domain without protocol prefixes or paths. Private or internal-only TLDs may not resolve from external scan nodes. Rate limits allow 8 scans per day and 3 per hour on the free tier — wait and retry if exceeded.
If few or no subdomains are found, the domain may have minimal public footprint, restrictive CT logging, or recently registered status. Premium brute force and permutation engines discover names absent from passive sources. Warnings in completed_with_warnings reports indicate partial source failures — results may still be useful but incomplete.
- DNS Lookup — Query detailed DNS records for discovered subdomains
- Port Scanner — Scan open ports on IPs resolved from subdomains
- SSL Checker — Validate TLS certificates on HTTPS subdomains
- Packet Analyzer — Analyze traffic to discovered hosts
- Subdomain Takeover — Premium takeover vulnerability detection
- All Free Tools — Browse the complete ScanSuite tool catalog
- Network Scanning — Enterprise network and ASM capabilities
Frequently Asked Questions
How do I find all subdomains of a domain?
Enter the domain and the tool collects subdomains from public sources such as certificate transparency (crt.sh), subfinder results and DNS data, then shows which ones resolve. No method can guarantee every subdomain, because internal-only names are not published.
Why does subdomain discovery matter for security?
Forgotten subdomains often run outdated software or point to deleted cloud resources, which risks a subdomain takeover. Finding them is a standard first step in attack-surface reviews.
Is subdomain enumeration legal?
Passive lookups of public records are generally fine. Active brute-forcing or scanning of systems you do not own should only be done with authorisation.
What is a subdomain takeover?
It happens when a DNS record (often a CNAME) still points to a deleted service, such as a cloud bucket or app, so an attacker can claim that service and serve content on your subdomain.
What is an online subdomain finder?
An online subdomain finder discovers hostnames beneath a root domain using certificate transparency logs, passive OSINT sources, and DNS resolution \u2014 accessible from a web browser without installing Subfinder, Amass, or other CLI tools. ScanSuite's free tier uses crt.sh for Certificate Transparency search, Subfinder for passive source aggregation, and DNS resolution for A, AAAA, and CNAME records. Results include discovered subdomain names, resolution status, IP addresses, and the sources that surfaced each hostname.
How does the ScanSuite subdomain finder work?
Enter a root domain and click Scan. ScanSuite validates the domain, queries crt.sh for TLS certificates listing subdomains in Subject Alternative Name fields, runs Subfinder to aggregate passive sources like DNS archives and search engines, merges and deduplicates findings, then resolves DNS records for each unique hostname. Discovery events stream to your browser in real time. The completed report shows discovered, resolved, and active HTTP counts with a detailed subdomain table and shareable 24-hour public URL.
What is certificate transparency and crt.sh?
Certificate Transparency (CT) is a public logging system where certificate authorities publish every TLS certificate they issue. The crt.sh service searches these logs, revealing subdomains listed in certificate SAN fields \u2014 often including staging, internal, and forgotten hostnames. CT search is passive: it queries public logs rather than sending traffic to the target's DNS or web servers. This makes crt.sh one of the most effective passive subdomain discovery sources available on ScanSuite's free tier.
What is Subfinder and how is it used here?
Subfinder is an open-source passive subdomain discovery tool that queries dozens of public sources including DNS history databases, search engines, threat intelligence feeds, and code repositories. On ScanSuite's free tier, Subfinder runs in passive mode only \u2014 aggregating publicly available subdomain hints without active wordlist brute forcing. Results merge with crt.sh findings and undergo DNS resolution to confirm which hostnames currently resolve.
Does the free subdomain finder use brute force?
No. The free PUBLIC_FREE policy explicitly disables brute force enumeration, permutations, HTTP probing, port scanning, and takeover detection. Free discovery relies exclusively on passive sources (crt.sh and Subfinder) plus DNS resolution. Brute force wordlist scanning and permutation engines are Premium features requiring an authenticated ScanSuite subscription.
Does the free tool detect subdomain takeover?
No. Subdomain takeover detection analyzes dangling CNAME records pointing to deprovisioned cloud resources (S3 buckets, Azure endpoints, GitHub Pages, etc.). This requires Premium ScanSuite. The free tier maps discovered hostnames and DNS records but does not assess takeover risk. For dedicated takeover scanning, see our Premium subdomain takeover tool at /scan/subdomain-takeover.
How many subdomains can the free tier find?
The free tier returns up to 50 discovered subdomains per scan, enforced by the PUBLIC_FREE max_results policy. This cap covers the majority of passive discovery results for typical corporate domains. Premium removes the limit and enables continuous monitoring with change alerts when new subdomains appear in future scans.
What DNS records does the free tier resolve?
The free tier resolves A (IPv4), AAAA (IPv6), and CNAME records for each discovered subdomain. Resolution confirms whether a hostname currently points to live infrastructure. MX and TXT records are not included in the free subdomain report \u2014 use our DNS lookup tool for comprehensive record queries on specific hostnames.
Why do some subdomains show as unresolved?
A subdomain may appear in certificate transparency logs or passive sources but lack current DNS records. Common causes include decommissioned services whose certificates remain in CT archives, internal-only hostnames never published to public DNS, typos in certificate SAN fields, and wildcard certificate entries. Unresolved status does not mean the name is safe to ignore \u2014 it may indicate stale infrastructure requiring DNS cleanup.
What does completed_with_warnings mean?
A completed_with_warnings report indicates the scan finished but one or more discovery sources failed or timed out. Partial results are still returned \u2014 review the warnings banner on the report page for details about which sources encountered errors. Common causes include upstream API rate limits on crt.sh or Subfinder provider timeouts. Retry later or upgrade to Premium for redundant source coverage.
Is this subdomain finder free?
Yes. ScanSuite's free subdomain finder requires no signup. It performs passive discovery via crt.sh and Subfinder with DNS resolution, streaming results in real time and producing a shareable 24-hour report. Free tier limits: 50 results per scan, 8 scans per day, 3 scans per hour. Premium adds brute force, permutations, HTTP probing, port scanning, takeover detection, unlimited results, and permanent private reports.
How is ScanSuite different from running Subfinder locally?
Local Subfinder requires installation, API key configuration for some providers, and manual merging of results with DNS resolution tools. ScanSuite runs the full pipeline server-side \u2014 crt.sh query, Subfinder aggregation, deduplication, DNS resolution, and structured reporting \u2014 from cloud infrastructure with a shareable web report. Local tools offer more customization and scripting; ScanSuite offers zero-install convenience and team-friendly report URLs.
Can I share subdomain scan results?
Free scans generate a public report URL immediately upon completion, accessible to anyone with the link for 24 hours. Reports include the subdomain table, discovery counts, source attribution, and warnings if applicable. Premium subscribers store encrypted private reports permanently with export options. Avoid sharing reports containing sensitive internal naming conventions if your policy restricts such disclosure.
Should I scan my own domain?
Yes \u2014 mapping subdomains on domains you own is a security best practice recommended by OWASP, NIST, and attack surface management frameworks. Shadow IT, forgotten staging environments, and orphaned DNS records frequently surface only through external enumeration. Schedule regular passive scans after infrastructure changes, acquisitions, and certificate renewals to maintain accurate external asset inventory.
How does subdomain discovery relate to MITRE ATT&CK?
MITRE ATT&CK technique T1590.002 (Gather Victim Network Information: DNS) and T1590.001 (Domain Properties) describe adversary reconnaissance that includes subdomain enumeration. Defenders use the same techniques during authorized assessments to identify exposure before attackers. ScanSuite supports defensive reconnaissance with documented reports suitable for remediation tracking and compliance evidence.
Can I probe HTTP services on discovered subdomains?
HTTP probing \u2014 checking whether subdomains serve live web content and capturing status codes \u2014 requires Premium ScanSuite. The free tier reports active_http_count as zero because HTTP probing is disabled in the PUBLIC_FREE policy. After passive discovery, manually visit resolved subdomains or upgrade to Premium for automated HTTP service detection across all discovered hostnames.
What rate limits apply to free subdomain scans?
The free tier allows 8 subdomain scans per day and 3 per hour per client IP address. Individual domains are capped at 20 scans per day to prevent abuse. If you exceed limits, wait for the rolling window to reset or upgrade to Premium for higher quotas and scheduled scanning.
Summary
ScanSuite's free subdomain finder discovers hostnames via certificate transparency (crt.sh), Subfinder passive enumeration, and DNS resolution — up to 50 results with no signup. Premium unlocks brute force, permutations, HTTP probing, takeover detection, and continuous monitoring for comprehensive attack surface management.