Subdomain Finder
Discover publicly visible subdomains using Certificate Transparency records.
What is a subdomain finder?
A subdomain finder discovers hostnames that have been publicly associated with a domain. WhatAnIP uses Certificate Transparency data, which records certificates issued for publicly trusted TLS websites and can expose hostnames included in certificate names.
Certificate Transparency is valuable for passive discovery because it does not require actively scanning the target domain. However, results can include historical hostnames and will not necessarily contain every subdomain that currently exists.
How to find public subdomains
- Enter the root domain you want to investigate.
- Run the Subdomain Finder.
- Review the unique hostnames discovered from available Certificate Transparency records.
Understanding subdomain results
A hostname appearing in Certificate Transparency means it was included in a publicly logged certificate. It does not guarantee that the hostname is still active, still resolves in DNS or still belongs to the same infrastructure.
Some internal or non-TLS subdomains will never appear in Certificate Transparency. For that reason, the result should be treated as a useful public inventory rather than a complete list of every possible hostname.
Common uses for subdomain discovery
- Identify public services associated with a domain.
- Discover historical hostnames used by an organization.
- Build an inventory for your own domain infrastructure.
- Find hostnames worth checking with DNS tools.
- Review public certificate exposure during security analysis.