Certificate logs can expose your hostnames
Public certificate logs can reveal subdomains you might prefer to keep out of sight. Anyone can search them, including attackers.
Subdomain finder that shows what attackers can see
Find subdomains, exposed services and takeover risks for free. Monitor your attack surface daily and get alerted when something changes.
- Subdomains
- 5.3M+
- Domains
- 41.4k+
- Services
- 5.8M+
Forgotten subdomains become attack surface
Every launch, test server and vendor trial adds a subdomain, and few are removed when the work ends. Those leftovers are part of your external attack surface, and attackers go looking for them.
Dangling DNS and takeovers
Deleting a cloud resource without removing its DNS record can leave a subdomain pointing to an unclaimed service. In some cases, someone else can claim that service and host content on your subdomain.
Services left open
Forgotten hosts can leave databases, admin panels and remote desktops exposed to the internet. Without monitoring, that exposure can go unnoticed.
The 2-minute tour
See how SubAnalyzer works
Scan a domain, read the results, spot a takeover risk and turn on monitoring, in about two minutes.
Chapters
0:000:00 Start a scan. This is SubAnalyzer. Here's how it finds and watches your subdomains. Type any domain and press Scan. Nothing to install, and no DNS access required.
0:130:13 How scanning works. A light scan searches certificate transparency logs and passive DNS. A deep scan also queries live DNS for likely names, SRV records and zone transfers. Every name discovered is resolved, and the hosts behind it are scanned for open ports. Finally, every CNAME is checked for potential takeover risk.
0:350:33 The results. The result: every subdomain, what's reachable, where it's hosted and what it exposes. Each subdomain shows its IP addresses, network owner, cloud provider and open ports. Hover over a port to see the detected service and why it matters. Web hosts get a screenshot and page title, making forgotten staging sites easy to spot.
1:020:58 Takeover detection. Here, one subdomain is flagged red for a potential takeover. Its CNAME still points to an Azure web app that no longer exists. An attacker could claim that resource and serve their own content on promo.example.com. Paid plans identify the affected service, so you know exactly what needs fixing.
1:261:22 Monitoring. Press Monitor and SubAnalyzer will scan the domain again every day. Every monitored domain shows its alerts and when the next scan will run. Choose exactly which changes you want to be alerted about. You can also switch to weekly or monthly checks.
1:561:44 Alerts. When something changes, you get a single email with takeover risks shown first. One click takes you straight to the change. Scan your domain for free at subanalyzer.com.
Subdomain takeover
You deleted the app.Your DNS record still points to it.
What is a subdomain takeover?
A subdomain takeover happens when a DNS record still points at a cloud service you no longer use. Whoever claims that name can publish anything on your subdomain.
How a takeover happens
How to prevent subdomain takeover
Remove the DNS record before you delete the service it points to, and keep checking where every CNAME points. Monitoring runs that check for you every day, free for 1 domain.
Subdomain takeover: how it happens and how to prevent itDaily monitoring
Subdomain monitoring with takeover alerts
Your external attack surface changes with every launch, migration and vendor. SubAnalyzer re-scans your domains every day and sends one email when something changes, with takeover risks at the top.
See monitoring plans1 domain free, up to 10 on a paid plan
Built for
Security teams
Keep your subdomain and service inventory current between pentests, without running scans by hand.
Bug bounty hunters
Get alerted to new subdomains and newly opened ports on your targets within a day.
Business owners
Know what your company exposes on the internet, even without a security team.
Start for free, upgrade when you need more
A free account scans without limits and monitors 1 domain every day. Paid plans monitor up to 10 domains and add takeover details and export.
Prices in US dollars, plus VAT or sales tax where it applies. Hover or tap any feature for details.
Frequently asked questions
Short answers about scans, takeover risks and monitoring. Something else on your mind? Contact us.
See all questionsHow do I find all subdomains of a domain?
Enter the domain in the scan box to search for its subdomains. A light scan reads public sources such as certificate transparency logs and passive DNS data. A deep scan then asks live DNS for likely names, looks up SRV records and tries a zone transfer, and keeps the guessed names that resolve. No tool can promise every subdomain, because a name that never appears in public DNS, certificates or datasets can stay hidden. How SubAnalyzer finds and verifies subdomains walks through every step.
What is a subdomain finder?
A subdomain finder, also called a subdomain scanner or subdomain checker, is a tool that discovers the subdomains associated with a domain name. It scans public records, DNS data and other sources to reveal subdomains like mail.example.com or dev.example.com that may not be immediately visible.
Does SubAnalyzer check for subdomain takeovers?
Yes. Every scan checks each subdomain's CNAME against cloud and SaaS services where an unclaimed name can be registered by someone else, including Azure services, AWS S3 and Elastic Beanstalk. A free scan flags the subdomains at risk. Paid plans name the service each one is exposed to, which is what tells you how to fix it. Our guide on how subdomain takeover happens and how to prevent it explains the risk.
Can SubAnalyzer alert me when my subdomains change?
Yes. SubAnalyzer re-scans your monitored domains every day, 1 on a free account and up to 10 on a paid plan, and sends one email when something changes: new or removed subdomains, DNS and CNAME changes, owner and cloud changes, open ports, and takeover risks, which are listed first. You choose which changes trigger an alert.
Is SubAnalyzer free?
Yes. Every scan is free, with light and deep discovery, every subdomain it finds, screenshots and change history. Without an account you get 2 scans a day. A free account scans as many domains as you like and monitors 1 domain every day, with email alerts. Paid plans start at $12.50 a month, billed yearly, and add monitoring for up to 10 domains, takeover detection that names the exposed service, screenshot refresh, re-scans on demand and export to CSV/JSON. Visit our pricing page for details.
See what your domain exposes
Free, with no account needed.