Free tool · Attack surface
Free subdomain finder for your own domain.
Forgotten staging sites, old admin panels and test environments are favourite entry points. Attackers find them through public certificate logs in minutes. So can you.
A subdomain finder lists the hostnames under your domain, such as staging.example.com or admin.example.com, by searching public certificate transparency logs and DNS. It shows your external attack surface: every subdomain that answers on the internet is something an attacker can probe.
What to look for in the list
- Staging, test and dev sites that are public but forgotten
- Admin panels and dashboards reachable from the internet
- Old marketing or campaign sites running outdated software
- CNAMEs pointing at cloud resources that no longer exist
- Services that should sit behind a VPN
For full results, the scanner confirms you own the domain with a work email on the same domain, so the list is only shown to its owner.
Frequently asked questions
How does a subdomain finder work?
It searches certificate transparency logs, where every publicly trusted certificate is recorded, and queries DNS for the names it finds.
Is it legal to look up subdomains?
Certificate transparency logs are public. Sumrite’s scanner only runs deeper checks on domains you confirm you own.
What should I do with forgotten subdomains?
Remove what you do not need, put internal tools behind a VPN, and include the rest in your penetration test scope.
More free tools
Found more than you expected?
Sumrite tests your external attack surface by hand.