Security
Subdomain Finder
Enter a domain, then list host names already published in certificate transparency logs. Each name is resolved to a public IPv4 address and marked when that address is on Cloudflare. The scan is not stored.
Quick start
- 1
Enter the domain
Use a domain you are reviewing. Do not include a path.
- 2
Start the scan
The lookup reads published names. It does not brute-force a word list.
- 3
Read the table
Each row shows the host, a public IPv4 address, and whether that address is on Cloudflare.
- 4
Export
Copy the table or download CSV or JSON. A scan returns at most 120 names and is not stored.
Features
Published names
Read host names from certificate transparency instead of guessing a word list.
Address and country
Resolve each name to a public IPv4 address and show the country of the most common address.
Cloudflare
An orange cloud means the address is in Cloudflare’s published ranges. Copy, CSV, and JSON export the table.
Specifications
- Source
- Certificate transparency
- Limit
- 120 names per scan
- Columns
- Subdomain, IP, Cloudflare
- Privacy
- Not stored
Use cases
- See which hosts a certificate has published.
- Check whether addresses sit on Cloudflare.
- Export a host list during a review you are allowed to run.
Frequently asked questions
Is this a vulnerability scan?
No. It lists published names and public addresses. It does not test services or hidden hosts.
Why is a host missing?
It was not in the certificate transparency results, or the scan already reached 120 names.