Subdomain Finder for Security Professionals
Map your external attack surface in one quick scan. Enumerate subdomains, detect subdomain takeover vulnerabilities, identify services, cloud providers, and ownership, with screenshots of every live web service.
How it works
Every scan moves through a five-stage pipeline. Results land in a searchable dashboard with screenshots and CSV or JSON export.
Light scan
Passive discovery
Deep scan
Active enumeration
IP scan
Resolve & enrich
Port scan
Detect services
Verify
Vulnerability checks
Why choose SubAnalyzer?
Most tools stop at listing subdomains. SubAnalyzer gives you instant screenshots, searchable results, and a clean interface, so you spend less time on setup and more time on actual recon.
What is a subdomain
A subdomain is a part of a larger domain name and is often used to organize different sections of a website.
While subdomains are useful for structuring websites, they can also be easy to forget.
If not properly secured, subdomains may expose hidden services or legacy systems, which can become potential entry points for attackers.
That's why discovering and monitoring subdomains is an important step in protecting your online presence.
- www.example.comLive
- blog.example.comLive
- cdn.example.comTakeover risk
- mail.example.comLive
- shop.example.comLiveServicesWeb80HTTP443HTTPSIP OwnerCloudflare, Inc. (ASN: 13335)cloudflare.com
- legacy.example.comTakeover risk
Know your subdomains
Each subdomain you create increases the number of entry points into your systems.
Whether it's used for development, testing, or older applications, a forgotten or poorly configured subdomain can become an easy target for attackers.
Subdomains often host different services, have separate access controls, or link to third-party tools. If one is not properly secured or monitored, it can expose data, open the door to attackers, or even be taken over.
By keeping track of your subdomains, you gain better control over your public-facing infrastructure. It helps reduce security risks, improves your visibility, and supports both compliance and incident response efforts.
How we identify subdomains
Our subdomain discovery process is designed to be thorough, structured, and privacy-respecting.
We start by gathering publicly available information from reliable sources to find known subdomains associated with your domain. After the initial discovery, we expand our search using intelligent techniques that help identify hidden or lesser-known subdomains that might not be easily visible through conventional methods.
Each potential subdomain is then carefully validated through real-time resolution checks to confirm its existence and activity. Once validated, we conduct further analysis to discover additional details, such as active services, providing a deeper understanding of your external attack surface.
By combining these layers of discovery and validation, we deliver a comprehensive and accurate map of your domain's presence online.
Our 3-step process
Initial discovery
Gathering publicly available information from reliable sources
Expanded exploration
Intelligent techniques to uncover hidden subdomains
Validation and analysis
Resolution checks and focused network analysis