Free subdomain finder

Discover the subdomains attached to your domain — including the forgotten ones that become entry points.

Free · no account · instant.

What it checks

Passive + active enumeration

We combine public sources and active resolution to find subdomains your inventory may have missed.

Live vs dormant

We show which subdomains actually resolve and respond — the ones that matter.

Takeover risk

Dangling records pointing at unclaimed services are flagged for subdomain-takeover risk.

Services behind them

For each live subdomain we surface the open ports and services it exposes.

Frequently asked

How does the subdomain finder work?

It enumerates subdomains using public intelligence and active DNS resolution, then verifies which are live and what they expose.

Why find subdomains?

Forgotten subdomains are a top entry point for attackers. Finding them is the first step to reducing your attack surface.

Is it free?

Yes — no account required. Subdomain discovery is part of the free attack surface scan.

Want this continuously, not once?

The free tool is a snapshot. SICenter monitors your whole estate and alerts you the moment something changes.

Start monitoring free