How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (2024)

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (1)




Aug 27, 2020

6 Mins Read

Subdomains are critical assets of your software applications and server infrastructure. They contain numerous details that can be useful to threat actors as a way into your system.

In essence, a subdomain is simply an addition to the root/main domain, however, it ends up being a completely independent site.

Reasons to have a subdomain can be different and the most important one is organizing website content. Very frequent examples you may have come across are:


The list goes on to tens or even hundreds of them.

Why are subdomains important?

Developers usually test new features using or, instead of directly updating the existing domain. However, after the official release, these subdomains can end up being not managed well enough, and that’s what may lead to security issues and serious risk to your business.

A hacker can uncover critical vulnerabilities affecting your assets by simply finding applications running on an exposed but forgotten subdomain, and you may be prone to an attack without realizing it.

In order to protect your assets, in this case, subdomains, you need to first see how exposed you are. To do so, it’s advised to run your domain against some subdomain finder tools. This will be useful for understanding your attack surface.

There is, of course, the old fashioned way of brute-forcing possible combinations – but that is definitely time-consuming, and hackers have faster and easier solutions nowadays.

Quick tip: Some services might not give complete results, and some might give old subdomains that are not currently used. If you decide to use free services to find your subdomains, we advise using a couple of them and saving results from all, just in case.

Besides, we gave you a lot of options, and the majority of services are fast. You will be doing a great deed to your organization simply by validating your results.

Free online services

There are many paid tools that will give you in-depth knowledge of your subdomains, but you can also leverage free services. They will do the job just as fine (if you know how to use them).

1. DNSdumpster

DNS dumpster is a project used to get host-related information. It gives DNS server, MX record, TXT record information as well.

A graph view and .xlsx downloadable file option are also available.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (3)

2. Nmmapper

NMMapper searches the domain you enter in the search box in different tools like Sublist3r, Amass, Nmap, etc. These are known to be powerful tools used for subdomain enumeration, but installing and using them might be harder than using a free online service.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (4)

You have the option to find the IP address the results resolve to, but that can be time-consuming.

3. Sypse

Spyse’s subdomain finder service allows you to collect subdomains of any domain. Sypse offers many tools and you can get the paid version for more in-depth results. However, the subdomain results from the free version alone can be quite useful.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (5)

4. Netcraft

Not exactly the perfect tool to find subdomains because as noted in the website “Only web sites which have been visited by users of the Netcraft Extensions at least five times within the last six months will be shown in the search results.”. However, it has a large domain database and you can profit from it. The way that this tool operates, is finding all (sub)domains containing a keyword that you give.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (6)

Without losing time on different tools to find additional information about a subdomain, you can easily view the detailed report that Netcraft offers.

5. Pentest-Tools

Pentest-Tools offers only 2 free scans daily, but that will do the job considering the in-depth reports it offers and the option to download those reports in PDF as well.

It’s easy to use! You write the domain name, hit scan, and get the report in a short while, depending on the number of subdomains you will retrieve.

6. SecurityTrails

SecurityTrails possesses 12 years of historical DNS records and offers it to users for free. It also offers a list of all subdomains of a root domain together with the hosting and mail provider.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (8)

Since it contains historical data, the list can be overlong, but the good thing is that you get more results than in other tools. Besides, you can always use the filtering option to shorten the list and get more accurate results.

7. Censys

Censys is an amazing tool. You can benefit from it in different ways, like getting information about websites or IP addresses. Although it is not intentionally meant to retrieve subdomain information, it can still be more useful than many other free services.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (9)

If you select the certificate search, Censys gives you information about certificates registered in any domain containing the words you write in the search box. If you write your domain name, the results list can be useful but not well filtered. However, if you do your search as follows, it will limit the search only to your subdomains.


Just like Cencys, offers a certificate search service. It is completely free and gives detailed information about certificates registered on a domain or subdomain.

You can simply write the root domain, and the results will end up in long lists of certificates. One thing you need to be careful about is that it gives duplicate results and to not get confused you need to make them unique. Another disadvantage is that it doesn’t offer an option to download the list.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (10)

9. BinaryEdge

Another not completely free tool is BinaryEdge. It is a powerful tool to find, besides others, subdomains as well. It offers 250 queries a month for the free version, and that is quite enough to once in a while check your digital assets.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (11)

10. Subdomain Finder

Subdomainfinder is specially designed to retrieve subdomains of a given root domain. After the result you will see subdomain, which you can visit by simply clicking on it, the IP address it resolves, and whether it is tunneling through CloudFlare or not.

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (12)
Discover SOCRadar® Community Edition for free

With SOCRadar® Community Edition, you’ll be able to:

  • Discover your unknown hacker-exposed assets
  • Check if your IP addresses tagged as malicious
  • Monitor your domain name on hacked websites and phishing databases
  • Get notified when a critical zero-day vulnerability is disclosed

Free for 12 months for 1 corporate domain and 100 auto-discovered digital assets.

Related Articles

A Look at the Security Challenges Threatening E-Commerce Websites – Vulnerabilities, Skimmers, Phishing

Jun 03, 2024

The Impact of Cyber Attacks on the Stock Markets

May 03, 2024

Top 10 Takeaways from Verizon DBIR 2024 Report

May 02, 2024

Compliance Through Vigilance; SOCRadar XTI for Compliant Organizations

Apr 18, 2024

The Importance of Supply Chain Security for Safeguarding Business Ecosystems

Mar 28, 2024

Subscribe to our newsletter and stay updated on the latest insights!

How to Find Subdomains Using Free Online Services? - SOCRadar® Cyber Intelligence Inc. (2024)


How do I find the subdomain of a website online? ›

There are several ways to find subdomains:
  1. Manually, by using the site:* operator in Google.
  2. By checking DNS records using the nslookup command.
  3. By using our online subdomain scanner or similar tools.

What is the best tool to find subdomains? ›

The Best Subdomain Enumeration Tools
  • Google Dorking. Google Dorking is a passive subdomain enumeration technique using Google's advanced search operators, like "site:" to find information about a target, including subdomains. ...
  • Sublist3r. ...
  • Amass. ...
  • Recon-ng. ...
  • SubDomainizer. ...
  • Pentest Tools Subdomain Finder. ...
  • ...
  • Shodan.
May 13, 2024

How do I find subdomains in Google? ›

Google Dorking

Google Dorks are one of the best ways to find extenstive information about a target. Google's search operators make it easy to narrow down the search to find more subdomains. We can use the "site" operator in the search bar to find all the subdomains that Google has indexed for a domain.

Does www work for subdomains? ›

“www” is actually a subdomain, although by convention it always seems to go to the main page of the site. It could go to a completely different page if that made sense for some site. And there is no reason why you couldn't use “www” for a subdomain.

How do I find all the subsites of a website? ›

You can usually locate it in the root or footer section of the website. For example, the XML sitemap URL could be ““. Once you click on the sitemap, you will find all pages & subpages of a website. You can use different sitemap generation tools if you don't have an existing sitemap.

What does a subdomain URL look like? ›

While a subdomain will appear before your TLD, a subdirectory link will include the subdirectory name after the original TLD. For example: Subdomain example: Subdirectory example:

Who owns a subdomain? ›

Let's say you are making a pitch to a client to create their new website. You can create a subdomain that is specifically intended for them to give an idea of what their new website might look like. This is hosted on your own main domain, while retaining ownership of the subdomain.

Does Google see subdomains as separate sites? ›

Despite the fact that Google has said it doesn't matter which you choose – a subdomain or subdirectory – subdomains are treated as entirely separate sites and you even verify them separately in Google Search Console.

Does Google Search Console include subdomains? ›

Yes. you can verify your subdomain to be used in Google Search Console by linking your account to Google Analytics. This way you avoid customizing the theme of your help center. Go to and set up a property within your Google Analytics account for your subdomain.

Do all websites have subdomains? ›

No they don't. If you go to, you will see it doesn't redirect to a www subdomain. And yes, there will always be a . between the parts of the hierarchy.

Should you use www or not? ›

The choice of which to use is really just a matter of preference, that's all. There are absolutely no SEO benefits to choosing one over another. What's important is that you stay consistent with the one that you chose at the time of starting your website.

Why do people use www subdomains? ›

By implementing subdomains on your website, you can create separate sections of content and services for your website without having to create new domain names for each part. Subdomains will also make it easier for users to find what they need, all in one place.

What is my subdomain domain? ›

A subdomain is an extension of your domain that helps you organize content and expand your business offerings. It allows you to create standalone pages or functions, such as a blog or online store.

What is the difference between a domain and subdomain of a website? ›

Regular domains are your standard URLs like or splashthat. events. Subdomains are a unique URL that lives on your purchased domain as an extension in front of your regular domain like or

Can a website have a subdomain? ›

A subdomain is, as the name would suggest, an additional section of your main domain name. You create subdomains to help organize and navigate to different sections of your main website. Within your main domain, you can have as many subdomains as necessary to get to all of the different pages of your website.


Top Articles
Latest Posts
Article information

Author: Fr. Dewey Fisher

Last Updated:

Views: 5647

Rating: 4.1 / 5 (42 voted)

Reviews: 81% of readers found this page helpful

Author information

Name: Fr. Dewey Fisher

Birthday: 1993-03-26

Address: 917 Hyun Views, Rogahnmouth, KY 91013-8827

Phone: +5938540192553

Job: Administration Developer

Hobby: Embroidery, Horseback riding, Juggling, Urban exploration, Skiing, Cycling, Handball

Introduction: My name is Fr. Dewey Fisher, I am a powerful, open, faithful, combative, spotless, faithful, fair person who loves writing and wants to share my knowledge and understanding with you.