Subdomain Explorer — Certificate Transparency OSINT

The Subdomain Explorer searches Certificate Transparency logs through crt.sh. It lists hostnames that appeared on publicly logged certificates — passive recon, not port scanning.

How to use

1. Enter a root domain you are authorized to assess
2. Review the deduplicated hostname list
3. Validate live names with DNS Lookup

Limits

• Internal hostnames never certificated will not appear
• Historical certs may list retired hosts
• When crt.sh is down (HTTP 502), retry later — this is an upstream outage, not your domain

Ethics

Use only for domains you own or have written permission to investigate.