Find subdomains by searching public Certificate Transparency logs. Results include all subdomains that have ever had an HTTPS certificate issued.
Enter a domain to discover its subdomains via Certificate Transparency logs
Certificate Transparency (CT) is a public, append-only ledger of every TLS/SSL certificate ever issued by participating Certificate Authorities. Since certificates include the domain names they cover, CT logs are a comprehensive source of subdomain enumeration - no active scanning required. This tool queries the Certificate Transparency database via CertSpotter, which indexes CT logs from all major CAs including Let's Encrypt, DigiCert, and Sectigo. When CertSpotter does not answer, the tool asks crt.sh, another CT log search. The addresses and mail servers of the subdomains found are then looked up through Cloudflare DNS, with VLANlab's own resolver when Cloudflare does not answer.
Results include subdomains that are no longer active, wildcard certificates are excluded (a cert for *.example.com does not reveal specific subdomains), and subdomains only reachable over HTTP (no HTTPS) will not appear. Results are based on the most recent 1,000 certificates and are cached for 1 hour.