IP y red

Subdomain Finder

Find subdomains from public SSL certificate logs and check which of them still resolve in DNS. Passive: we never contact the hosts themselves.

What this search can and cannot see

Only names that received a public SSL certificate: certificate authorities must log every certificate in Certificate Transparency logs. Internal names without a certificate and subdomains without HTTPS do not show up.
A wildcard certificate (*.example.com) hides the actual names: subdomains served under it appear only as "*".
Logs keep old certificates too, so the list includes names that are long gone — that is what the DNS column is for.
The search is passive: no wordlist guessing, no port scanning, no visiting the hosts found. DNS answers come from Cloudflare's and Google's public resolvers, up to 300 names per check.

Found forgotten subdomains? Check what runs on them

Old test and service subdomains often run outdated CMSs nobody updates. PromoPilot Shield checks a site from the outside: security headers, TLS and the certificate, exposed .git/.env and backups, CMS vulnerabilities, SPF/DKIM/DMARC/CAA. Add each important subdomain as its own site. Monitorización desde $12/mes: reanálisis programados y alertas sobre nuevas amenazas y caducidad del certificado.

Free website scan Sobre Shield

Datos clave

When a site gets an SSL certificate, the names in it land in public Certificate Transparency logs. We read those logs and check the names in DNS, so you see subdomains that ever had a certificate. This is passive discovery with no dictionary brute force: subdomains without a certificate and internal names will not be found.

Precio: Gratis
Registro: No necesario
Procesamiento: On our server: it asks public certificate logs (crt.sh, Cert Spotter as fallback) for the names in a domain’s certificates and then checks them in DNS over DNS-over-HTTPS
Entrada: A domain (for example example.com)
Límites: No sign-up: 6 checks per minute and 15 fresh ones per day (45 after sign-in, unlimited for Pro); names are cached for 24 hours; up to 300 names are checked in DNS
Resultado: A list of subdomains from certificates with a DNS status (live, not in DNS, dangling CNAME), addresses and the CNAME chain; a warning about possible subdomain takeover
Última actualización: 2026-10-26

Find subdomains from Certificate Transparency logs

This subdomain finder is passive: names come from public Certificate Transparency logs (crt.sh, or Cert Spotter when crt.sh is down), are cleaned of "*." and duplicates, and up to 300 of them are checked in DNS — which resolve, where CNAMEs point and which CNAMEs dangle on a target that no longer exists. Nothing is sent to the hosts themselves: no wordlist brute force, no port scan, no page visits. Free, no sign-up — 15 searches a day, 45 with a free account.

Names from Certificate Transparency logs: crt.sh and Cert Spotter

DNS for up to 300 names: A, AAAA, CNAME chain, NXDOMAIN

Dangling CNAMEs and services prone to subdomain takeover

Cloudflare/CDN hints, wildcard DNS detection, CSV export

Cómo usar

Enter a domain, e.g. example.com
The first search takes up to 30–40 seconds; after that the name list is cached for a day
Filter by status, export CSV and remove dangling CNAMEs

FAQ

Enter the domain: we take the names in certificates issued for it from Certificate Transparency logs and check them in DNS. You cannot find “all” subdomains; only those that ever got a certificate are visible.

It probably never had a separate certificate (for example it is covered by a wildcard certificate or runs on HTTP). The crt.sh log may also have failed to respond.

The subdomain has a CNAME to an external address, but the final name no longer exists. If that is a service such as cloud storage or hosting, the name may have been released and the subdomain could potentially be taken over; check and remove the record.

No. We do not brute-force names, scan ports or send HTTP requests to the hosts found; we only read public certificate logs and DNS.

Guests get 15 fresh checks a day, 45 after sign-in, unlimited for Pro, with 6 requests per minute. The name list is cached for 24 hours and up to 300 names are checked in DNS.

PromoPilot frente a alternativas: comparación

Comparamos solo lo que está confirmado en las páginas de cada servicio. Donde no pudimos confirmar un dato, la celda muestra "—".

Parámetro	PromoPilot	crt.sh	DNSdumpster
Source: Certificate Transparency logs	✓	✓ search by identity (domain, organization), fingerprint or crt.sh ID	—
DNS status and dangling CNAME check	✓	—	✓ discovers hosts related to a domain from DNS records
Dictionary brute force	✗	—	—
Free without sign-up	✓ with a daily limit	—	✓ a free tool (limits are not stated on the page)

Desplaza la tabla hacia los lados

Dónde somos más débiles: we find only subdomains with public certificates, without brute force or scanning, check at most 300 names in DNS, and a daily limit applies.

Cuándo elegir PromoPilot: When you want to quickly see the publicly known subdomains of your own or another domain and find forgotten records with a dangling CNAME. For a complete list, brute force and scanning use specialised reconnaissance tools, which we deliberately do not run.

Comprobado el: 2026-10-16. "—" significa que no está confirmado en la página oficial; las condiciones y los precios cambian, así que consulta los sitios de cada servicio.