Find every subdomain of a domain
Paste a domain to list every host its certificates have named in the public certificate transparency logs, and whether each still answers in DNS. It is the lookup hostnag's Discover runs, read from crt.sh, or Cert Spotter when crt.sh is down.
How to read this
- Live
- The name resolves to a public address today.
- Points nowhere
- The name is a CNAME to a name that no longer exists: how a subdomain takeover usually starts. Signed in, Discover judges each one against the hosting providers that can be claimed.
- Gone
- The name no longer resolves, or resolves only to a private address.
- Not judged
- The lookup ran out of time before this name, or its DNS did not answer; nothing is claimed about it.
Questions
Where do the names come from?
Certificate transparency logs: every publicly trusted certificate is logged with every name it covers. The finder reads crt.sh and, when crt.sh does not answer, Cert Spotter, which lists unexpired certificates only; the result says when that happened.
Is this a scan?
No. It reads public logs and looks each name up in DNS once. A name that points at a hosting provider may get one plain web request, the way a browser would ask.
Why is there a daily limit?
The certificate logs limit how often one address may ask, and hostnag's own certificate watches ask from the same address. So a visitor gets five lookups a day, the site makes a fixed number of fresh ones, and a domain looked up in the last day is answered from that lookup.
What does an account add?
Discover in the app judges every host for subdomain takeover, turns the live ones into website and certificate monitors in one step, and a CT watch alerts on every new certificate issued for the domain.
Related
Watch this for good.
Start free