A subdomain is a prefix of a domain name that creates a separate address within the same domain. For example, mail.example.com, api.example.com, and staging.example.com are all subdomains of example.com. Subdomains can point to different servers and are often used to separate services, environments, or geographic regions.

How does subdomain enumeration work?

This tool uses certificate transparency (CT) logs — public databases where Certificate Authorities record every TLS certificate they issue. When a certificate is issued for a subdomain, it is logged publicly. By searching CT log aggregators like crt.sh, we can enumerate subdomains that have had certificates issued without needing to brute-force DNS.

What are certificate transparency logs?

Certificate Transparency (CT) is a security standard that requires all publicly trusted TLS certificates to be logged in append-only public ledgers. This was introduced to catch mis-issued certificates. A side effect is that CT logs reveal every hostname a certificate was ever issued for, making them an effective and passive subdomain enumeration source that requires no guessing.

Why would I want to find subdomains of a domain?

Subdomain enumeration is a standard first step in penetration testing, bug bounty hunting, and attack surface mapping. It reveals forgotten or unmonitored subdomains, staging/dev environments accidentally exposed to the internet, third-party services attached to a domain, and potential entry points that may have weaker security than the main site.

Will subdomain enumeration find all subdomains?

CT logs cover subdomains that have had public TLS certificates issued. Subdomains running on HTTP-only, internal services, or with wildcard certificates (*.example.com) may not appear individually. For a more complete picture, combine CT log enumeration with DNS brute-forcing using wordlists. This tool gives a passive, zero-noise starting point.

Is subdomain enumeration legal?

Reading public certificate transparency logs is legal — the data is intentionally public. The subdomains discovered this way are already publicly known to anyone who checks CT logs. Subdomain enumeration is legal when used for your own domains, authorized security assessments, or bug bounty programs with explicit scope authorization. Unauthorized testing of systems you don't own may violate computer access laws.

▤profilemyip.com

all systems

Network & Privacy

Subdomain Finder

Find subdomains of any domain via certificate transparency logs

Frequently Asked Questions

WHOIS Lookup

Look up WHOIS details for any domain or IP address.

→

DNS Record Lookup

Query A, AAAA, MX, CNAME, TXT, and NS records for any domain.

→

SSL Certificate Checker

Check any domain's SSL/TLS certificate — issuer, expiry, SANs, and cipher.

→