Subdomain Explorer

Discover subdomains from Certificate Transparency logs via crt.sh

Root domain

Passive CT search only — results may be historical.

Try an example:

Examples

Surface audit for a corporate domain

Input

example.com

Output

www.example.com, api.example.com, mail.example.com, …

CT logs reveal hostnames that appeared on publicly trusted certificates.

About this tool

Subdomain Explorer searches Certificate Transparency logs via crt.sh. It is passive OSINT: names come from certificates that were publicly logged, not from DNS brute force or port scanning.

Results can be incomplete (internal names never certificated) or stale (retired hostnames). When crt.sh is down, the tool returns a clear upstream-unavailable message — retry later.

How to use

Enter a root domain
Use a domain you own or have authorization to investigate (example.com, not a full URL).
Explore subdomains
Browse the deduplicated hostname list returned from CT logs.
Validate findings
Cross-check important names with DNS lookup or your asset inventory before acting.

Use cases

Forgotten hostname discovery

Find old dev/staging hosts still present in CT history before an audit.

Certificate inventory

See which subdomains have been certificated over time.

Common mistakes

Mistake:Treating CT results as live DNS.

Fix:A hostname in CT may no longer resolve — confirm with DNS lookup.

Mistake:Scanning third-party domains without authorization.

Fix:Use only for domains you own or have written permission to assess.

Frequently asked questions