Free subdomain finder

It shows the hostnames under your domain that appear in public Certificate Transparency logs, which record every TLS certificate issued by a trusted authority. If a host ever had a certificate, it is in the list, whether or not it is still running. This tool also flags names that suggest development, staging or legacy systems.

It does the same job without scanning. A typical subdomain scanner guesses names from a wordlist and sends DNS queries or requests to see which ones exist. This tool looks up subdomains in Certificate Transparency logs, so it finds every name that has had a certificate and never touches your hosts. A subdomain that never had its own certificate will not appear, such as an internal-only host or one covered only by a wildcard certificate. To find those you need your DNS zone records or an active scan you are authorized to run.

Enter the domain in the subdomain checker above and run it. You get a list of every subdomain found in Certificate Transparency logs, with dev, staging and other non-production names flagged. Then check each one: run it through the DNS lookup to see whether it still resolves, and use the SSL checker and security headers checker on the hosts that are live.

Truvo maps footprint findings to SOC 2 CC3.2, CC6.1 and CC7.1, and to ISO 27001:2022 Annex A controls A.5.9 (inventory of information and other associated assets) and A.8.8 (management of technical vulnerabilities). Exposed non-production hosts additionally map to CC6.6 and A.8.31. The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

Yes. The tool reads public log data about certificates that were already issued. It does not connect to, scan or probe any of the hosts it lists.

Hosts nobody manages tend to run outdated software, lack monitoring and sit outside the patch cycle, which makes them a common entry point. Staging hosts add weaker authentication, verbose errors and debug tooling while being reachable from the whole internet. The fix is to inventory the list, decommission what you no longer need, and put non-production environments behind authentication or a VPN.

Not by itself. A large count means your attack surface is probably bigger than the one your team actively manages, and it gives an auditor a simple test of your asset inventory: does every host on the list have an owner, a patch status and a reason to exist.

A subdomain is a host name under your domain, such as app.example.com or staging.example.com. Each one can point at a different server, and each one is part of your external attack surface. Forgotten subdomains that still resolve, especially dev, staging and admin hosts, are a common way in, which is why enumerating them is the first step of an external assessment.