Certificate logs can expose your hostnames
Public certificate logs can reveal subdomains you might prefer to keep out of sight. Anyone can search them, including attackers.
Subdomain finder that shows what attackers can see
Find subdomains, exposed services and takeover risks for free. Monitor your attack surface daily and get alerted when something changes.
- Subdomains
- 5.5M+
- Domains
- 42.2k+
- Services
- 5.9M+
Forgotten subdomains become attack surface
Every launch, test server and vendor trial adds a subdomain, and few are removed when the work ends. Those leftovers are part of your external attack surface, and attackers go looking for them.
Dangling DNS and takeovers
Deleting a cloud resource without removing its DNS record can leave a subdomain pointing to an unclaimed service. In some cases, someone else can claim that service and host content on your subdomain.
Services left open
Forgotten hosts can leave databases, admin panels and remote desktops exposed to the internet. Without monitoring, that exposure can go unnoticed.
The 2-minute tour
See how SubAnalyzer works
Scan a domain, read the results, spot a takeover risk and turn on monitoring, in about two minutes.
Chapters
0:000:00 Start a scan. This is SubAnalyzer. Here's how it finds and watches your subdomains. Type any domain and press Scan. Nothing to install, and no DNS access required.
0:120:12 How scanning works. A light scan searches certificate transparency logs and passive DNS. A deep scan also queries live DNS for likely names, SRV records and zone transfers. Every name discovered is resolved, and the hosts behind it are scanned for open ports. Finally, every CNAME is checked for potential takeover risk.
0:340:32 The results. The result: every subdomain, what's reachable, where it's hosted and what it exposes. Free scans show up to 1,000 subdomains from the light scan, and paid plans show all discovered subdomains. Each subdomain shows its IP addresses, network owner, cloud provider and open ports. Paid plans include screenshots, page titles and page types for web hosts, making forgotten staging sites easier to spot. The Sources tab shows how many subdomains each technique found. Download the full results as a PDF report, CSV or JSON with a paid plan. With a paid plan, the full AI summary puts the most urgent findings first.
1:251:20 Takeover detection. Here, one subdomain is flagged red for a potential takeover. Its CNAME still points to an Azure web app that no longer exists. An attacker could claim that resource and serve their own content on promo.example.com. Paid plans identify the affected service, so you know how to fix it.
1:461:37 Monitoring. With a paid plan, select Monitor to scan the domain again every day. Choose exactly which changes you want to be alerted about.
2:041:49 Alerts. When something changes, you get a single email with takeover risks shown first. One click takes you straight to the change. Scan your domain for free at subanalyzer.com.
Subdomain takeover
You deleted the app.Your DNS record still points to it.
What is a subdomain takeover?
A subdomain takeover happens when a DNS record still points at a cloud service you no longer use. Whoever claims that name can publish anything on your subdomain.
How a takeover happens
How to prevent subdomain takeover
Remove the DNS record before you delete the service it points to, and keep checking where every CNAME points. A paid plan checks for takeover risks daily on up to 10 monitored domains.
Subdomain takeover: how it happens and how to prevent itDaily monitoring
Subdomain monitoring with takeover alerts
Your external attack surface changes with every launch, migration and vendor. SubAnalyzer re-scans your domains every day and sends one email when something changes, with takeover risks at the top.
View monitoring plansUp to 10 domains on a paid plan
Built for
Security teams
Keep your subdomain and service inventory current between pentests, without running scans by hand.
Bug bounty hunters
Get alerted to new subdomains and newly opened ports on your targets within a day.
Business owners
Know what your company exposes on the internet, even without a security team.
Start for free, upgrade when you need more
Scan or look up 2 domains a day for free. View up to 1,000 subdomains from each light scan, with every takeover risk flagged. Paid plans show all discovered subdomains and include unlimited scans, takeover risk details, screenshots and monitoring for up to 10 domains.
Prices are in US dollars. VAT or sales tax may apply. A card is required for the trial. Cancel before your 7-day trial ends to avoid being charged. Hover over or tap a feature for details.
Frequently asked questions
Short answers about scans, takeover risks and monitoring. Something else on your mind? Contact us.
See all questionsHow do I find all subdomains of a domain?
Enter the domain in the scan box to search for its subdomains. A light scan reads public sources such as certificate transparency logs and passive DNS data. A deep scan then asks live DNS for likely names, looks up SRV records and tries a zone transfer, and keeps the guessed names that resolve. No tool can promise every subdomain, because a name that never appears in public DNS, certificates or datasets can stay hidden. How SubAnalyzer finds and verifies subdomains walks through every step.
What is a subdomain finder?
A subdomain finder, also called a subdomain scanner or subdomain checker, is a tool that discovers the subdomains associated with a domain name. It scans public records, DNS data and other sources to reveal subdomains like mail.example.com or dev.example.com that may not be immediately visible.
Does SubAnalyzer check for subdomain takeovers?
Yes. Every scan checks each subdomain's CNAME against cloud and SaaS services where an unclaimed name can be registered by someone else, including Azure services, AWS S3 and Elastic Beanstalk. Free scans flag subdomains with potential takeover risks. Paid plans also identify the affected service, so you know how to fix it. Our guide on how subdomain takeover happens and how to prevent it explains the risk.
Can SubAnalyzer alert me when my subdomains change?
Yes. With a paid plan, SubAnalyzer scans up to 10 monitored domains daily and sends an email when something changes. Alerts cover new or removed subdomains, CNAME changes, cloud provider changes, open port changes and takeover risks. Takeover risks appear first, and you choose which changes trigger an alert.
Is SubAnalyzer free?
Yes. You can scan or look up 2 domains a day for free. With a free account, you can save scans to your dashboard and keep accessing them after you reach your daily limit. The free view shows up to 1,000 subdomains from the light scan and flags every takeover risk. Paid plans start at $12.50 a month, billed yearly, and show all subdomains found by both light and deep scans. They include unlimited scans, takeover risk details, the full AI summary, screenshots, change history, monitoring for up to 10 domains, re-scans on demand and exports to CSV or JSON. Your first Monthly subscription includes a 7-day free trial. Visit our pricing page for details.
See what your domain exposes
Free, with no account needed.