Subdomain finder
List the names under a domain that appear in public certificates, with when each was first seen and where it points now.
Results for example.org
Passive: certificate logs only
2 subdomains of example.org
Names seen in public certificates between 2011 and today. We did not check where they point. This is the list of names that appear in certificates. It is not everything that exists.
Each hides the names under it
Most names first appeared in 2014: 2 of 4. 1 non-host name (such as an email address) was left out.
Names4
Group byNameNetworkFirst seen year
*.example.orgFirst seen 2025-01-15 · last seen 2026-12-25 · 16 certificatesWildcard
- DNS now
- A wildcard covers any single name, so there is no one address to look up
- Certificates
- 16 certificates, from 2025-01-15 to 2026-12-25, one valid now
example.orgThe domain itself · First seen 2014-11-06 · last seen 2026-12-25 · 29 certificatesNot checked
- Certificates
- 29 certificates, from 2014-11-06 to 2026-12-25, one valid now
www.example.orgFirst seen 2014-11-06 · last seen 2026-12-02 · 12 certificatesNot checked
- Certificates
- 12 certificates, from 2014-11-06 to 2026-12-02, one valid now
www.testdomain.example.orgFirst seen 2011-01-11 · last seen 2016-01-10 · 1 certificateNot checked
- Certificates
- 1 certificate, from 2011-01-11 to 2016-01-10
Export
All 4 names, not only this page. Downloads work without JavaScript.
Structured result (JSON) · 2.1 KB
{
"domain": "example.org",
"resolve": false,
"includeExpired": true,
"groupBy": "name",
"source": {
"kind": "ct",
"asOf": "2026-11-15T18:21:43.314Z",
"sources": [
"crtsh"
],
"stale": false
},
"counts": {
"names": 4,
"subdomains": 2,
"wildcards": 1,
"listed": 4,
"checked": 0,
"resolved": 0,
"dangling": 0,
"unresolved": 0,
"timedOut": 0,
"nonHost": 1,
"capped": false
},
"names": [
{
"name": "*.example.org",
"label": "*",
"firstSeen": "2025-01-15",
"lastSeen": "2026-12-25",
"certCount": 16,
"wildcard": true,
"current": true,
"resolved": {
"status": "not_applicable"
}
},
{
"name": "example.org",
"label": "",
"firstSeen": "2014-11-06",
"lastSeen": "2026-12-25",
"certCount": 29,
"wildcard": false,
"current": true
},
{
"name": "www.example.org",
"label": "www",
"firstSeen": "2014-11-06",
"lastSeen": "2026-12-02",
"certCount": 12,
"wildcard": false,
"current": true
},
{
"name": "www.testdomain.example.org",
"label": "www.testdomain",
"firstSeen": "2011-01-11",
"lastSeen": "2016-01-10",
"certCount": 1,
"wildcard": false,
"current": false
}
],
"strip": [
{
"period": "2011",
"n": 1
},
{
"period": "2012",
"n": 0
},
{
"period": "2013",
"n": 0
},
{
"period": "2014",
"n": 2
},
{
"period": "2015",
"n": 0
},
{
"period": "2016",
"n": 0
},
{
"period": "2017",
"n": 0
},
{
"period": "2018",
"n": 0
},
{
"period": "2019",
"n": 0
},
{
"period": "2020",
"n": 0
},
{
"period": "2021",
"n": 0
},
{
"period": "2022",
"n": 0
},
{
"period": "2023",
"n": 0
},
{
"period": "2024",
"n": 0
},
{
"period": "2025",
"n": 1
}
],
"page": {
"page": 1,
"pages": 1,
"perPage": 100
}
}Next step
- Certificate searchSee the certificates behind these namesCheck example.org in Certificate search
- DNS lookupCheck one name in detailCheck example.org in DNS lookup
- Who hosts this siteWho hosts the main site?Check example.org in Who hosts this site
What passive means
Passive means we only read public certificate records. We do not guess names, try a wordlist, scan ports or contact the domain you enter. Every name on the page was written into a certificate that a trusted authority issued and logged in public.
That is also its limit. A subdomain that never had a certificate will not appear: a site that only uses plain HTTP, a name used inside a company, or a name covered by a wildcard certificate. A wildcard such as *.example.com hides the individual names under it, so we can show that it exists but not what it covers.
The list is therefore the names that appear in certificates. It is a good map of the public side of a domain, and it is not everything that exists.
How to use it
- Enter a domain you own or may look atType a domain such as
example.com. A public suffix such asco.ukis refused, because it is not one domain. - Choose whether to check where names pointSwitch on "Check where each name points now" to look up the address of up to 200 names, and the network behind each one. It is slower, so it is off by default.
- Scan the listThe subdomain part is in bold and the domain is quiet, so hundreds of names are easy to read. Each row shows when the name was first and last seen and how many certificates named it.
- Look at the stripThe strip above the list shows how many new names appeared in each year, or each month for a young domain. It shows when the estate grew.
- Export itCopy the names on the page, or download all of them as CSV or JSON. The export always holds the whole list, not just the page you are on.
# The same list from a terminal, with where each name points
curl "https://lookupowl.com/api/v1/tools/subdomain-find?domain=example.org&resolve=true"Names that may be forgotten
When names are checked, one pattern is worth a look: a name that is a CNAME to a hosted service, where the service name it points at no longer exists. That is the shape of a forgotten record, and for some hosted services it can mean someone else is able to register the missing name and serve content on yours.
We mark such names "possibly forgotten" and say what they point at. It is a hint from the way the name looks, not a confirmed problem, and we never try to take anything over or fetch the name to find out. If one of your own names is flagged, the fix is to remove the DNS record or to reclaim the service it points at.
Where the names come from
The names come from Certificate Transparency, the public logs where certificate authorities record what they issue. We read them through crt.sh and Cert Spotter and share the data with the certificate search, which shows the certificates behind these names. Each name keeps the dates of the first and the last certificate that named it, which is why an old name can show up long after the site is gone.
- Email addresses and other non-hosts that appear in certificates are left out, and the page says how many.
- Wildcards are listed as wildcards and are not looked up, because they do not name a host.
- At most 2,000 names are listed, the most recently seen first, and at most 200 are looked up in DNS.
- Searches for one domain are paced, because the logs have small quotas.
What people use it for
- Owners tidying up. Find the test, staging and old project names that still have a record, and the ones that point at a service you cancelled.
- Security reviews. Map the public side of a company's domain before an assessment, from information that is already public.
- Migrations. List the names that must move before a change of host or DNS provider. For the hosting of the main site, use the website hosting lookup.
- Learning. See how a real domain is laid out and how it grew over the years.
To look closer at one name from the list, open it in the DNS lookup.
Questions people ask
Is the list complete?
No. It is the names that appear in public certificates. A name with no certificate, an internal name and anything hidden behind a wildcard will not show up. Treat it as a good start, not a full inventory.
Do you scan the domain or guess names?
No. We only read public certificate records. We never guess names, use a wordlist, scan ports or contact the domain you enter, and there is no option to turn any of that on.
Why is a name here that does not exist any more?
Certificates keep a name on record after the site is gone, and the logs never forget. The first and last seen dates show how old a name is, and "No address now" marks names that no longer answer in DNS.
What does "possibly forgotten" mean?
The name is a CNAME to a hosted service, and the name it points at no longer exists. Someone else may be able to claim it. It is a hint, not proof, and we do not try to claim or fetch anything.
Why were some names left out?
Certificates sometimes name email addresses or other things that are not hosts. We leave those out and tell you how many. Names on the same certificate that belong to other domains are not shown either.
Why only 200 names looked up?
Each lookup is a question to the DNS, and we keep the work fair for everyone. The 200 most recent names are checked and the rest are listed without addresses. The export still holds every name.
Can I run this from a script or an AI assistant?
Yes. The same list is available as JSON from the REST API and as the subdomain_find tool on the MCP server. There is no key or signup, and the same limits apply.
Use it from AI, the API or the command line
Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is subdomain_find. Please be kind to the rate limits.
curl "https://lookupowl.com/api/v1/tools/subdomain-find?q=example.org"claude mcp add --transport http lookupowl https://lookupowl.com/mcp