Free Subdomain Finder & Lookup

The Subdomains Lookup tool discovers all known subdomains associated with a root domain - for example, finding blog.example.com, api.example.com, and staging.example.com for the root example.com. The results come from WhoisFreaks' database of 6.4B+ hostnames.

Subdomains represent the full attack surface of an organization's web presence. Unmaintained or forgotten subdomains (especially staging, dev, or legacy ones) are frequent targets for subdomain takeover attacks, where an attacker claims the subdomain by registering the underlying resource it points to.

A subdomain takeover occurs when a subdomain's DNS record points to an external service (for example GitHub Pages, Heroku, or AWS S3) that is no longer claimed by the organization. An attacker can then claim that service and take control of the subdomain. This tool helps you enumerate all subdomains so you can audit which ones point to external resources that could be vulnerable. For each candidate subdomain, run a DNS Lookup to check the CNAME target, and a SSL Lookup to verify the certificate is still valid.

WhoisFreaks builds its hostname database from multiple sources including DNS record crawls, SSL certificate transparency logs (which often list subdomains in SAN fields), passive DNS collection, and zone file analysis for supported TLDs.

No tool can claim 100% subdomain coverage because organizations may use internal-only subdomains that never appear in public DNS. However, WhoisFreaks' database of more than 6.4B+ hostnames provides one of the broadest public coverage sets available.

Security professionals use them for attack surface mapping and penetration testing reconnaissance, DevOps teams use them to audit subdomain sprawl, bug bounty hunters use them to find overlooked subdomains as potential vulnerability targets, and brand protection teams use them to detect phishing infrastructure related to domains.