Subdomain Finder
List a domain's subdomains and find the ones exposed to a takeover through a forgotten alias.
What this tool checks
- Every known subdomain of the domain
- Aliases (CNAMEs) that point to names that no longer exist
- Hosting services showing an "unclaimed" page for the name
- Available on Pro and Agency, for the domains your account monitors
How to read the results
- Pass
- The check succeeded based on the observed responses.
- Warning
- Works now, but is risky, unusual or worth reviewing.
- Fail
- A problem was observed directly in the responses.
- Inconclusive
- Not enough evidence — for example a server did not respond.
Part of Pro and Agency
Subdomain scans list a domain's whole infrastructure, so they are kept for domains you monitor, where they also run on every check.
See plans