Attack Surface
Subdomain Finder
Enumerate a domain's subdomains from several independent sources at once — certificate transparency logs, passive DNS and issuance records — merged into one list with resolved IPs and Cloudflare proxy status.
Passive only — nothing is sent to the target domain. A first-time lookup runs a live scan and can take up to ~45 seconds on large domains; repeat lookups are cached.