What this tool shows
Every time a TLS certificate is issued, it is recorded in public certificate transparency logs. Because certificates name the hosts they cover, those logs are a reliable way to enumerate a domain's subdomains, including ones that are not linked anywhere. This finder pulls that list, then resolves each name so you can see which subdomains point to a live host right now.
Frequently asked questions
How does this find subdomains without scanning?
It reads certificate transparency logs, the public record of every certificate issued. Since certificates list their hostnames, the logs reveal subdomains passively, without probing the target.
Why are some subdomains not live?
A subdomain can appear in a certificate but no longer resolve, or point to an internal host you cannot reach. The tool marks which names resolve to a public IP so you can tell active from stale.
Will it find every subdomain?
It finds those that have ever had a certificate in the logs, which covers most modern setups. Subdomains that never used a public certificate, or use wildcards, may not appear.