Skip to main content
Network and domains tools

Network and domains / FREE TOOL

Free subdomain finder

Find subdomains in public certificate records, with a contributed-database fallback, source attribution and a dated lookup.

Use the names you find when you scope AI penetration testing, and compare the plans on pricing.

Passive public-data lookup

Start with a public domain

This lookup sends your domain to BreachLine and public subdomain sources. Successful public results may be cached for up to five minutes, with their original collection time. It does not probe hosts, check DNS, or confirm that names are active. Free requests share a limited allowance.

Subdomain names

Follow the public records.

Enter a domain to find names in certificate records, with a public contributed database as a fallback. Results can include historical or inactive names and are not a complete asset inventory.

 

A QUICK WALKTHROUGH

How to use it

  1. 01Enter a public domain name without a URL path.
  2. 02Run the lookup to query public records without probing the domain.
  3. 03Review the source, collection time and coverage limits before exporting names.

Next, test what you find with Nebula.

What this check can tell you

Queries public certificate records through BreachLine, falling back to the Anubis DB public contributed database if certificate sources fail. Contributed observations are unverified. Records can be historical, incomplete or unavailable; a listed name is not proof of a live host, current ownership or a vulnerability. No target scanning, DNS brute forcing or service probing is performed. Free shared usage limits apply.

The domain you submit is sent to BreachLine and public certificate sources or the Anubis DB contributed database. No request is sent to the target host.

Certificate Transparency overview

Copy this HTML to link to the Subdomain finder.

<a href="https://breachline.io/tools/subdomain-finder">Subdomain finder</a>