Your hostnames are public
Public certificate logs can reveal subdomains you might prefer to keep out of sight. Anyone can search them, including attackers.
Subdomain finder that shows what attackers can see
Find subdomains, exposed services and takeover risks for free. Monitor your attack surface daily and get alerted when something changes.
- Subdomains found
- 5.3M+
- Domains scanned
- 41.4k+
- Services found
- 5.7M+
Forgotten subdomains are an open door
Every launch, test server and vendor trial adds a subdomain, and few are removed when the work ends. Those leftovers are part of your external attack surface, and attackers go looking for them.
Dangling DNS and takeovers
Deleting a cloud resource without removing its DNS record can leave a subdomain pointing to an unclaimed service. In some cases, someone else can claim that service and host content on your subdomain.
Services left open
Forgotten hosts can leave databases, admin panels and remote desktops exposed to the internet. Without monitoring, that exposure can go unnoticed.
Subdomain takeover
You deleted the app.Your DNS record still points to it.
What is a subdomain takeover?
A subdomain takeover happens when a DNS record still points at a cloud service you no longer use. Whoever claims that name can publish anything on your subdomain.
How a takeover happens
Create
You point promo.example.com at an Azure Web App with a CNAME record.
Delete
The campaign ends and the app is deleted. The CNAME record stays.
Claim
Someone creates an Azure app with the same name. promo.example.com now shows their page.
How to prevent subdomain takeover
Remove the DNS record before you delete the service it points to, and keep checking where every CNAME points. Paid monitoring runs that check for you every day.
How dangling CNAME records enable subdomain takeoverDaily monitoring
Subdomain monitoring with takeover alerts
Your external attack surface changes with every launch, migration and vendor. SubAnalyzer re-scans your domains every day and sends one email when something changes, with takeover risks at the top.
See monitoring plansUp to 5 domains on any paid plan
Built for
Security teams
Keep your subdomain and service inventory current between pentests, without running scans by hand.
Bug bounty hunters
Hear about new subdomains and newly opened ports on your targets within a day.
Business owners
Know what your company exposes on the internet, even without a security team.
The 2 minute tour
See how SubAnalyzer works
Scan a domain, read the results, spot a takeover risk and turn on monitoring, in about two minutes.
Walkthrough coming soon
What the tour will cover
- Enter a domain
- Light and deep scan
- Reading results
- Spotting a takeover risk
- Turning on monitoring
- The daily email
Free scans, paid monitoring
Scanning is free for everyone. A paid plan keeps watching.
Free
$0for everyone
No account needed to start scanning. Sign up free to save domains to your dashboard.
- Light and deep scans
- Every subdomain a scan finds
- Screenshots of web-facing subdomains
- Takeover risks flagged
- Changes and scan history
- Up to 2 scans a day
Includes monitoring
Paid
$15a month
or $12.50 a month,billed yearly at $1502 months free
- Everything in Free
- Monitoring: 5 domains, re‑scanned daily
- Takeover detection that names the service
- Unlimited scans
- Screenshot refresh
- Export to CSV/JSON
Prices in US dollars. Compare every feature on the pricing page.
Frequently asked questions
Short answers about scans, takeover risks and monitoring. Something else on your mind? Contact us.
See all questionsHow do I find all subdomains of a domain?
Enter the domain in the scan box to search for its subdomains. A light scan reads public sources such as certificate transparency logs and passive DNS data. A deep scan then asks live DNS for likely names, looks up SRV records and tries a zone transfer, and keeps the guessed names that resolve. No tool can promise every subdomain, because a name that never appears in public DNS, certificates or datasets can stay hidden.
What is a subdomain finder?
A subdomain finder, also called a subdomain scanner or subdomain checker, is a tool that discovers the subdomains associated with a domain name. It scans public records, DNS data and other sources to reveal subdomains like mail.example.com or dev.example.com that may not be immediately visible.
Does SubAnalyzer check for subdomain takeovers?
Yes. Every scan checks each subdomain's CNAME against cloud and SaaS services where an unclaimed name can be registered by someone else, including Azure services, AWS S3 and Elastic Beanstalk. A free scan flags the subdomains at risk. Paid plans name the service each one is exposed to, which is what tells you how to fix it. Our guide on how dangling CNAME records enable subdomain takeover explains the risk.
Can SubAnalyzer alert me when my subdomains change?
Yes, on a paid plan. SubAnalyzer re-scans up to 5 monitored domains every day and sends one email when something changes: new or removed subdomains, DNS and CNAME changes, owner and cloud changes, open ports, and takeover risks, which are listed first. You choose which changes trigger an alert.
Is SubAnalyzer free?
Yes. Every scan is free, with light and deep discovery, every subdomain it finds, screenshots and change history, up to 2 scans a day. Paid plans start at $12.50 a month, billed yearly, and add unlimited scans, monitoring with email alerts, takeover detection that names the exposed service, and export to CSV/JSON. Visit our pricing page for details.
See what your domain exposes
Free, with no account needed.