This tool speaks the Model Context Protocol (MCP) and ships a REST API. Connect it once, then just ask your assistant to map the subdomains of a domain for you.
A subdomain finder enumerates the hostnames that live under a domain, such as mail.example.com, api.example.com or staging.example.com. This tool discovers them passively from Certificate Transparency logs through crt.sh, so it never scans or brute forces the target. It simply reads the certificates that public certificate authorities have already issued and logged for the domain.
How Certificate Transparency reveals subdomains
Certificate Transparency (CT) is a public, append-only record of every TLS certificate issued by trusted certificate authorities. Each certificate lists the exact hostnames it protects, including subdomains, in its subject and subject alternative name fields. Because those logs are public and searchable via crt.sh, querying a domain surfaces the subdomains that have ever appeared on a certificate, without sending any traffic to the target itself.
Why passive enumeration
Non-intrusive: it reads already-public certificate data, so nothing hits the target and there is no scanning noise.
Fast and broad: one query returns hostnames collected over years of certificate issuance.
Reliable coverage: any subdomain that has ever been served over HTTPS with a public certificate tends to show up.
Safe by default: no brute forcing wordlists, no port scans, no rate-limit risk on the target.
What to use the results for
Asset inventory: build a complete map of the hostnames your organization exposes, including forgotten staging and legacy hosts.
Attack surface mapping: security teams and bug bounty hunters use CT enumeration as the first step in reconnaissance.
Shadow IT discovery: surface subdomains spun up outside the usual process before someone else does.
Migration and cleanup: find every host that still needs a certificate, a redirect or a decommission.
How to find subdomains
Type the root domain (for example github.com) into the box above.
Select Find. The tool queries Certificate Transparency logs via crt.sh.
Read the count, then scroll the deduplicated, sorted list of discovered subdomains.
Copy the whole list or export JSON for your recon or asset-inventory workflow.
Frequently asked questions
What is a subdomain finder?
A subdomain finder enumerates the subdomains that exist under a domain, such as mail.example.com or api.example.com. This tool discovers them passively from Certificate Transparency logs via crt.sh, so it never scans or brute forces the target. It reads the certificates that have already been issued for the domain.
How does Certificate Transparency reveal subdomains?
Every time a public certificate authority issues a TLS certificate, it logs it to public Certificate Transparency logs. Those certificates list the exact hostnames they cover, including subdomains. By querying crt.sh for a domain, this tool collects every hostname that has ever appeared on a certificate, which surfaces subdomains without touching the target.
Is the subdomain finder free and open source?
Yes. It is completely free and open source under the MIT license, part of WebToolsHub by Konko Maji. It reads public Certificate Transparency data through crt.sh. There is no signup and no data is stored.
Is passive subdomain enumeration legal and safe?
Passive enumeration from CT logs only reads already-public certificate data, so it does not send any traffic to the target and is generally considered safe and non-intrusive. It is widely used for asset inventory and attack surface mapping. You are responsible for how you use the results.
Can I find subdomains inside Claude, ChatGPT or Gemini?
Yes. It ships an MCP server and a REST API, so you can connect it to Claude, ChatGPT, Gemini, Kimi, Cursor and any MCP client, then ask your assistant to enumerate the subdomains of a domain for you. See the connection guide.