No sitemap? Doesn't matter.

A sitemap covers one host. A company runs many — blog., docs., app., staging. This finds every subdomain on a domain, so you know the full footprint before you start digging.

Subdomain finder. Passive subdomain enumeration from public Certificate Transparency logs (crt.sh). No scanning, no packets sent to the target — just what CAs have already published.

Free subdomain finder tool for OSINT, passive recon, attack surface mapping, and competitive research. Discovers subdomains of any domain from crt.sh Certificate Transparency logs, deduplicated and sorted, with recently-issued certificates flagged.