Passive Reconnaissance

Subdomain Finder

Discover hidden subdomains by querying public Certificate Transparency (CT) logs.

This tool passively aggregates historical SSL/TLS certificates issued for the target domain via crt.sh. It does not actively probe the target servers.