Subdomain Finder
How it works
The finder runs subfinder on Strix infrastructure against passive sources only: certificate transparency logs, passive DNS datasets, search engines, and threat intelligence APIs. No packet reaches the target and no names are guessed. Names are lowercased, deduplicated, and limited to the registrable domain. When a source does not answer in time, the result is marked partial.
| Look for | Why |
|---|---|
| staging, dev, test, uat, old versions | Environments that should not be public |
| Heroku, S3, GitHub Pages, Azure names | Subdomain takeover candidates once the service is deleted |
| Hosts nobody announced | A common source of breaches |
| Hosts that no longer resolve | Passive data is historical. Resolve before you rely on it. |
Frequently asked questions
Keep exploring
- SSL/TLS Checker
Check a certificate, its expiry, chain, and TLS protocol support
Open tool - Email Security Checker
Check SPF, DMARC, DKIM, MTA-STS, and BIMI records for a domain
Open tool - Security Headers Checker
Grade a site's HTTP security headers and get the fixes
Open tool - CVE Database
Severity, EPSS, and KEV status for every CVE
Open tool
Start testing in minutes
Connect your GitHub repos and domains, and get fully set up in a few clicks.