Find a domain’s public subdomains from certificate logs and DNS data — with what each one points to and whether it’s still live.
Only the main domain, like example.com.
Certificate transparency logs and DNS — no brute-forcing.
Old records pointing at deleted services are flagged as takeover risks.
Only ones that appear in public sources: names that have had a public certificate. Internal names that never had one won’t show.
A DNS record still points at a service (like an old hosting account) that’s been deleted. Anyone can claim that service and serve content on your subdomain.
Yes — it only uses public data. We don’t scan or attack anything.