A subdomain wordlist contains names such as www, mail and vpn that discovery tools try against a domain to find its subdomains.
This list uses names from Certificate Transparency logs, the public record of every certificate browsers trust, where the names on each certificate can be read by anyone. It ranks them by how many domains use each name, and is rebuilt every month using domains from the Tranco top 100,000.
The first list is being built. The downloads and figures appear here once it is done.
How the list is made
- Which domains. The Tranco top 100,000, a research ranking of the most visited domains, less the one group in ten kept for the comparison.
- Which names. Every name under each domain in SubAnalyzer's own Certificate Transparency index, from all the logs browsers trust today and archives of older ones. For a domain with more than 40,000 names, the 40,000 seen most recently.
- How they count. Only the part directly under the domain counts, once per domain:
shop.example.comandwww.shop.example.comboth countshoponce, and*.cdn.example.comcountscdn. - Which names are excluded. Names fewer than 5 domains use. That keeps the list to names domains have in common, and reduces names specific to one organization.
- When. A new list is built at the start of every month, which takes about a day. This page and the files always show the latest one.