Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Free tool
Enter a domain to discover its known subdomains, sourced entirely from public Certificate Transparency logs, the same public record every trusted TLS certificate is logged to. Useful for mapping out a real attack surface before it's someone else who finds the forgotten staging subdomain first.
Passive only, sourced from public Certificate Transparency logs, the same record every publicly trusted TLS certificate is logged to. We never scan or brute-force the target directly.
By using this tool, you agree to our Terms of Service , only run it against something you own or are authorized to assess.
Forgotten subdomains are a common way into an org, we help inventory what's actually exposed and shut down what shouldn't be.