Guide · Updated · By William Lodge
How to Find Subdomains of a Website (Passive OSINT Methods)
Find a domain's subdomains without scanning it: certificate transparency logs, passive DNS sources, and how to verify and document what you find.
Subdomains reveal a lot about an organization: staging servers, forgotten marketing sites, login portals, and third-party services. Security teams enumerate them to understand their attack surface; researchers use them to map who operates what. The good news is that you can find most subdomains passively, without sending a single packet to the target.
1. Certificate Transparency logs
Every publicly trusted TLS certificate is recorded in public Certificate Transparency (CT) logs. Because certificates list the hostnames they cover, CT logs are one of the richest subdomain sources available.
crt.sh is a free search interface for these logs. Search for %.example.com (the % is a wildcard) to list certificates issued for any subdomain of example.com. Look at the Common Name and Matching Identities columns.
Keep in mind:
- CT logs show hostnames that had certificates — some no longer exist.
- Wildcard certificates (
*.example.com) hide the individual names behind them. - Internal hosts without public certificates won't appear.
2. Passive enumeration tools
Subfinder queries many passive sources at once — CT logs, search engines, and passive DNS datasets — and merges the results. A basic run looks like:
subfinder -d example.com -o subdomains.txtSome sources work without keys; others (several passive DNS providers) need free or paid API keys in subfinder's provider config to return their best results. subfinder is passive by default, which makes it a safe first step.
Censys indexes internet-facing hosts and certificates and can show which subdomains currently resolve to live services. It requires an account.
3. Search engines and archives
A site:example.com -www search surfaces indexed subdomains other than www. Archived copies on the Wayback Machine or archive.today can reveal subdomains that once existed and links that point to them.
4. Verify and enrich
Raw lists contain stale and duplicate names. For each subdomain worth investigating:
- Check whether it still resolves in DNS.
- Review it with Web-Check for DNS records, TLS details, headers, and hosting — a quick way to see what a host is without probing it aggressively.
- Check the IP's reputation on AbuseIPDB if you're investigating suspicious infrastructure.
Where passive ends and active begins
Brute-forcing subdomain names against a target's DNS servers, port scanning, and directory fuzzing are active techniques. They're standard in authorized penetration tests but can violate law or terms of service without permission. If you don't own the domain or have written authorization, stay passive.
Document as you go
Record each subdomain with its source (crt.sh, subfinder, search) and the date. DNS and hosting change constantly, so a dated record is what makes your findings useful later.
More tools for this task: Domain, DNS & IP.
You are responsible for authorization and the laws that apply to your research. OSINTCompass lists tools for lawful, ethical public-source research.