Free tool · No signup
Free subdomain finder
Enter a domain to see every meaningful subdomain from public Certificate Transparency logs, with a NEW tag for ones first seen in the last 90 days and an AI explanation of the notable ones.
* Subdomain categories and AI-generated descriptions are automated estimates and may be incorrect. They are provided as a starting point, not a verified assessment.
What is a subdomain finder?
A subdomain finder discovers the subdomains that sit under a domain: the app., api., checkout., and docs. hostnames beneath a company's root domain. Subdomains are a revealing signal: a new store. subdomain can hint at an upcoming commerce launch, enterprise. at a new tier, and partners. at a partner program.
This tool finds subdomains from public Certificate Transparency (CT) logs rather than by scanning or brute-forcing DNS. Every HTTPS website needs an SSL certificate, and every certificate is recorded in public, append-only CT logs the moment it is issued, often before a site is live. IntelCue continuously ingests these logs and strips out noise (wildcard certificates, deploy-platform hostnames like *.vercel.app, and random per-tenant IDs), so you get only the subdomains that carry meaning.
How it works
01
Enter a domain
Type any root domain: stripe.com, notion.so, a competitor. No login, no scanning of their servers; we only read public certificate records.
02
We pull meaningful subdomains from CT logs
IntelCue returns the subdomains it has observed in Certificate Transparency logs, newest first, after filtering out wildcards, deploy-platform hosts, and random noise.
03
See what's new and what it means
Recently-seen subdomains are tagged NEW, notable ones get a one-line AI explanation, and everything is grouped by category so patterns jump out.
This is a snapshot. IntelCue watches continuously.
This tool shows what we've already observed. IntelCue is a competitive intelligence platform that tracks a domain's Certificate Transparency footprint around the clock, alerting you the moment a competitor stands up a new subdomain, alongside monitoring for their newsletters, blogs, news, Google Ads, and more. Ask it anything in natural language right inside Claude or ChatGPT.
Free for early usersNo credit card required
Frequently asked questions
What is a subdomain finder?
A subdomain finder is a tool that discovers the subdomains of a given domain, for example app.stripe.com, api.stripe.com, and checkout.stripe.com under stripe.com. IntelCue's free subdomain finder sources subdomains from public Certificate Transparency logs, so it surfaces real subdomains that have been issued an SSL/TLS certificate, including ones that never appear in search engines.
How do I find all subdomains of a domain?
The most reliable, non-invasive method is searching public Certificate Transparency logs, since every subdomain that's ever been issued an SSL certificate is permanently recorded there. Other methods like DNS brute-forcing or search engine dorking exist, but both are noisier and less complete than reading CT logs directly.
How does the subdomain finder work?
Every HTTPS site needs an SSL certificate, and every certificate is published in public, append-only Certificate Transparency (CT) logs. IntelCue continuously ingests these logs and filters out noise (wildcards, deploy-platform hostnames, random per-tenant IDs), keeping only meaningful subdomains. When you enter a domain, we return the meaningful subdomains we have observed, newest first.
What does the NEW tag mean?
A subdomain is tagged NEW when it was first seen in Certificate Transparency logs within the last 90 days. It reflects when the subdomain first appeared in our CT data, not necessarily the subdomain's true creation date, so it is best read as 'recently observed' rather than 'definitely brand new.'
Why do some subdomains have an AI description?
For new and strategically notable subdomains, IntelCue uses AI to add a one-line explanation of what the subdomain likely is, for example flagging a new store, API, partner integration, or enterprise surface. Established or generic subdomains are grouped by category (product, marketing, infrastructure, integrations, internal) without an individual description.
Is the subdomain finder free?
Yes. It's completely free, requires no signup, and there's no limit beyond a light rate limit to keep the service fair for everyone.
Is finding subdomains from Certificate Transparency legal?
Yes. Certificate Transparency logs are public by design. They were created by Google to make SSL certificate issuance auditable. Reading them reveals only domain names that certificate authorities have already published. This tool performs no scanning of the target's infrastructure.
Can a new subdomain reveal an unannounced product launch?
Yes, this is a well-known OSINT technique. Companies often provision a subdomain, like checkout., store., or beta., and its SSL certificate weeks before a public announcement, so a new certificate showing up in Certificate Transparency logs can be an early signal. It isn't proof on its own, since many subdomains are internal, staging, or unrelated infrastructure.
Explore more IntelCue solutions
Competitive Intelligence
Full market & competitor monitoring suite
Google Ads Transparency
Monitor competitor search ad campaigns
Website Change Tracker
Detect changes on competitor pages
Newsletter Tracker
Monitor competitor email newsletters
New to the topic? Browse the competitive intelligence glossary.
Related reading
AI-First Competitive Intelligence: The Shift Changing CI in 2026
AI-first competitive intelligence is replacing manual CI workflows. Here's what's changing, which tools are adapting, and how to pick the right approach.
The Best Competitive Intelligence Tools for 2026: A No-Nonsense Guide
The best competitive intelligence tools for 2026, broken down by category. Honest comparisons, no vendor bias. Find the right fit for your team.
How to Choose Competitive Intelligence Software for SaaS in 2026
A practical buyer's guide to evaluating competitive intelligence platforms for early-stage SaaS teams. Compare features, integrations, and workflows that matter.