Subdomain Finder

Discover subdomains for any domain by brute-forcing DNS resolution against a wordlist. Use the built-in list of 35 common subdomain names (www, api, staging, admin, mail, ...) or upload your own .txt file. For passive discovery via TLS certificate history, see Certificate Transparency.