WORLDEYE PRO TOOL

Subdomain Finder — Enumerate a Domain's Subdomains

Give it a domain and get back the subdomains the public internet knows about — the forgotten dev boxes, staging servers and test panels that make up most of a domain's real attack surface.

DOMAIN TO ENUMERATE

PREVIEW — WORLDEYE PRO
Open in WorldEye

EXAMPLE RESULT — FORMAT ONLY, NOT A LIVE CHECK

Enumeration of a sample domain

www
www.example.com — resolves
mail
mail.example.com — resolves
dev
dev.example.com — resolves
staging
staging.example.com — resolves
legacy
legacy.example.com — in cert logs, no current DNS

This is the shape of a result, shown for the documentation domain example.com. The live finder runs inside WorldEye's RECON board and is included with WorldEye Pro. Only enumerate domains you own or are authorised to assess.

What enumeration can and can't find

  • Enumeration works from public traces — certificates issued, DNS records published, names observed. A subdomain that was never certificated, never published and never seen will not appear. No enumerator finds everything; this one shows its results as the public record, not the complete truth.
  • A listed subdomain is a name that resolves or once resolved. It is not proof the host behind it is alive today, or vulnerable — it is an inventory to verify, which is exactly what defenders need.
  • Enumerate domains you own or are authorised to assess. Listing public DNS data is legal research; probing what you find, beyond your authorisation, is a different matter.

Ask a company about its web presence and it will name its homepage. Ask its DNS and you get the truth: mail., vpn., dev., staging., an old campaign microsite, a test panel someone spun up in 2022 and never took down. Attackers know this — subdomain enumeration is the first move of almost every external assessment, because the forgotten subdomain is where the unpatched software lives.

WorldEye's Subdomain Finder does that first move inside the RECON board: enter a domain, and it assembles the subdomains visible in public records — certificate-transparency data, DNS and observed names — into a single inventory. Because it sits in the board, every name it returns is one click from the follow-ups that give it meaning: resolve its DNS, read its certificate history, check its headers and stack, scan its host.

For defenders this is housekeeping with teeth: you cannot patch what you don't know you run. For researchers it is the fastest way to understand how an organisation is actually built — which is usually a very different shape from the brochure site.

How it works

  1. 1Open the RECON board on the WorldEye globe and choose Subdomains in the Domain & Web group.
  2. 2Enter the root domain you own or are authorised to assess — example.com, not a full URL.
  3. 3Run the enumeration and read the inventory of subdomains returned from public records.
  4. 4Sort the surprises first: dev, staging, test, admin and old-looking names are where the risk concentrates.
  5. 5Work the list in the same board — DNS, Certs, Headers, Tech Detect and Port Scan each take a name straight from your results.

Run Subdomain Finder in WorldEye

Subdomain Finder runs live in WorldEye's RECON board — RECON board → Domain & Web → Subdomains — and is included with WorldEye Pro. Create a free account to explore the board and its free tools, and upgrade when you need the Pro modules.

Open the globeCreate a free accountSee WorldEye Pro

Subdomain enumeration questions

Where does the subdomain list come from?+
From the public traces subdomains inevitably leave: certificates issued for them (certificate-transparency logs are public by design), published DNS, and names observed in public data. That is why enumeration works at all — hiding a public service's name is nearly impossible once it has a certificate, and the same transparency that protects the web's trust model makes inventories like this possible.
Will it find every subdomain?+
No tool can promise that. A name with no certificate, no public DNS record and no appearances in observed data leaves no trace to find. What enumeration gives you is the publicly knowable surface — which, in practice, is the surface an attacker can also find, and therefore the surface that matters most to secure.
Why do companies have subdomains they don't know about?+
Because creating one takes five minutes and retiring one takes a decision. Campaigns end, vendors change, developers move on — the DNS record and the server stay. Shadow IT and forgotten staging environments are the normal state of large domains, not a scandal; the scandal is only in never looking.
Is subdomain enumeration legal?+
Compiling public records about a domain is research. The line is what you do next: testing the hosts you find — scanning, probing, logging in — needs the owner's authorisation. Enumerate your own domains freely; treat other people's results as reading, not an invitation.
What should I do with a risky subdomain I find on my own domain?+
Decide, in order: does it still exist, does it still need to, and is what runs there maintained? Most findings resolve into one of three actions — take it down, patch it, or formally accept it. The worst outcome is the fourth: writing it down and forgetting it again.
What does it cost?+
Subdomain Finder is a Pro module in WorldEye's RECON board, included with WorldEye Pro. The board's free tools — including the Data Leak Checker and Shodan IoT Lookup — need no account.

Keep exploring

Certificate Transparency Search — a domain's cert historyDNS Lookup — every record for a domainSecurity Headers Checker — audit a site's headersAll WorldEye tools

One email when the sky does something big

Rocket launches, storms overhead and new camera drops — plus major WorldEye news. Rare, and no spam, ever.

Instant subscribe — no confirmation email. We check the address as you type it in.

All WorldEye tools Open the live map