What the internet can see
Every certificate ever issued for your domain is a matter of public record. This reads those logs, finds hostnames you may have forgotten about, and checks which of them still resolve today — the same first move an attacker makes, and it costs them nothing either.
Passive checks only — nothing is scanned, attacked, or stored.
Why this is the first thing anyone looks at
Attacking a well-defended application is hard work. Finding the thing next to it that nobody remembered — a staging copy, an old admin panel, a monitoring dashboard someone stood up for a week in 2023 — is almost free. That is why reconnaissance starts here rather than at your front door.
The uncomfortable part of this check is rarely the count. It is recognising a hostname and realising you have no idea who owns it now.
What the results mean
In the logs is every hostname under your domain that has ever been issued a certificate. Names stay there permanently, so this includes things long since switched off.
Still resolving is the subset that has a DNS record right now. These are live in the sense that a browser can find them.
Worth a look is flagged on the name alone — words like admin, staging, vpn or jenkins. That is a heuristic, not a finding. It is telling you where to point your attention, not that something is wrong.
Read more
The fixed-price review goes further than this page can: what each host actually serves, which ones respond, expired certificates, and a prioritised list of what to turn off. Or run the other free checks first — they cover different ground.
Common questions
- How does this find subdomains without scanning me?
- It reads certificate transparency logs. Every certificate authority is required to publish a public, append-only record of every certificate it issues, so the moment anyone requests a certificate for staging.yourcompany.com, that hostname becomes a matter of public record — permanently, whether or not the host was ever deployed. This tool reads those logs and then does an ordinary DNS lookup on each name to see which still resolve. Nothing is connected to and no ports are touched.
- Can I stop my subdomains appearing in these logs?
- Not really, and trying is the wrong instinct. Certificate transparency exists so that a certificate cannot be issued for your domain without leaving evidence, which is a protection you want. Wildcard certificates hide individual names, but they bring their own problem: one private key that works for everything. The right response is to assume the names are public and make sure nothing sensitive depends on nobody knowing them.
- Why does it matter if an old subdomain still resolves?
- Because forgotten hosts don't get patched. The staging environment nobody has logged into since a migration is still running whatever version it was deployed with, often with a copy of real data and weaker authentication than production. It is also a common route to subdomain takeover: if a DNS record still points at a cloud service that has been deprovisioned, someone else can often claim that name and serve content from your domain.
- It found nothing. Am I safe?
- It means no certificates for subdomains of your domain appear in the public logs, which is genuinely useful to know but is not the same as having no attack surface. Hosts served over plain HTTP, or behind a service that terminates TLS on a different domain, never appear here. Neither does anything reachable only by IP address. A clean result narrows the question; it does not close it.
- Does this tell me whether those hosts are vulnerable?
- No, and it deliberately doesn't try. It reads names and resolves them. It does not connect to them, fingerprint them, or test anything. A hostname that looks alarming may be perfectly locked down, and a boring-looking one may be the problem. Judging that requires actually looking, which is a different piece of work.
- Is any of this stored?
- No. The lookup runs, the result is returned to your browser, and nothing is written down or logged against you. You could run the same queries yourself against crt.sh and dig; this just collates them and flags the names worth a second look.