Certificate logs can expose your hostnames
Public certificate logs can reveal subdomains you might prefer to keep out of sight. Anyone can search them, including attackers.
Subdomain finder that shows what attackers can see
Find subdomains, exposed services and takeover risks for free. Monitor your attack surface daily and get alerted when something changes.
- Subdomains
- 5.3M+
- Domains
- 41.4k+
- Services
- 5.7M+
Forgotten subdomains become attack surface
Every launch, test server and vendor trial adds a subdomain, and few are removed when the work ends. Those leftovers are part of your external attack surface, and attackers go looking for them.
Dangling DNS and takeovers
Deleting a cloud resource without removing its DNS record can leave a subdomain pointing to an unclaimed service. In some cases, someone else can claim that service and host content on your subdomain.
Services left open
Forgotten hosts can leave databases, admin panels and remote desktops exposed to the internet. Without monitoring, that exposure can go unnoticed.
Subdomain takeover
You deleted the app.Your DNS record still points to it.
What is a subdomain takeover?
A subdomain takeover happens when a DNS record still points at a cloud service you no longer use. Whoever claims that name can publish anything on your subdomain.
How a takeover happens
How to prevent subdomain takeover
Remove the DNS record before you delete the service it points to, and keep checking where every CNAME points. Paid monitoring runs that check for you every day.
How dangling CNAME records enable subdomain takeoverDaily monitoring
Subdomain monitoring with takeover alerts
Your external attack surface changes with every launch, migration and vendor. SubAnalyzer re-scans your domains every day and sends one email when something changes, with takeover risks at the top.
See monitoring plansUp to 5 domains on any paid plan
Built for
Security teams
Keep your subdomain and service inventory current between pentests, without running scans by hand.
Bug bounty hunters
Get alerted to new subdomains and newly opened ports on your targets within a day.
Business owners
Know what your company exposes on the internet, even without a security team.
Free scans, paid monitoring
Scanning is free for everyone. A paid plan keeps watching.
Prices in US dollars. Hover or tap any feature for details.
Frequently asked questions
Short answers about scans, takeover risks and monitoring. Something else on your mind? Contact us.
See all questionsHow do I find all subdomains of a domain?
Enter the domain in the scan box to search for its subdomains. A light scan reads public sources such as certificate transparency logs and passive DNS data. A deep scan then asks live DNS for likely names, looks up SRV records and tries a zone transfer, and keeps the guessed names that resolve. No tool can promise every subdomain, because a name that never appears in public DNS, certificates or datasets can stay hidden. How our subdomain scanner works walks through every step.
What is a subdomain finder?
A subdomain finder, also called a subdomain scanner or subdomain checker, is a tool that discovers the subdomains associated with a domain name. It scans public records, DNS data and other sources to reveal subdomains like mail.example.com or dev.example.com that may not be immediately visible.
Does SubAnalyzer check for subdomain takeovers?
Yes. Every scan checks each subdomain's CNAME against cloud and SaaS services where an unclaimed name can be registered by someone else, including Azure services, AWS S3 and Elastic Beanstalk. A free scan flags the subdomains at risk. Paid plans name the service each one is exposed to, which is what tells you how to fix it. Our guide on how dangling CNAME records enable subdomain takeover explains the risk.
Can SubAnalyzer alert me when my subdomains change?
Yes, on a paid plan. SubAnalyzer re-scans up to 5 monitored domains every day and sends one email when something changes: new or removed subdomains, DNS and CNAME changes, owner and cloud changes, open ports, and takeover risks, which are listed first. You choose which changes trigger an alert.
Is SubAnalyzer free?
Yes. Every scan is free, with light and deep discovery, every subdomain it finds, screenshots and change history, up to 2 scans a day. Paid plans start at $12.50 a month, billed yearly, and add unlimited scans, monitoring with email alerts, takeover detection that names the exposed service, and export to CSV/JSON. Visit our pricing page for details.
See what your domain exposes
Free, with no account needed.