Subdomain discovery

How the audit finds subdomains via Certificate Transparency, urlscan.io, OTX, and DNS probing — plus the honest limitations.

Why subdomains matter

Real web estates sprawl: blog., shop., docs., app., regional hosts, legacy microsites. Each can carry its own analytics stack, its own forgotten pixels, its own sitemap problems. Auditing only the apex domain misses all of it, so Include subdomains is checked by default.

Four free sources, unioned

No single free source sees every subdomain, so the finder queries four and unions the results (deduplicated, sorted, capped at 50):

1. Certificate Transparency logs (crt.sh) — every publicly trusted TLS certificate is logged; certificates name the domains they cover, which reveals subdomains.
2. urlscan.io — the public website-scan index; if anyone has scanned foo.example.com, the hostname is on record.
3. AlienVault OTX passive DNS — crowd-sourced DNS observations; used when an API key is configured.
4. DNS common-name probing — resolving a wordlist of common names (www, blog, shop, …) directly against DNS.

What each subdomain gets

Every discovered subdomain gets the same treatment as the parent: robots.txt → sitemap recursion, per-page audit, beacon scan — up to 200 pages each, all drawing from the single global page budget (parent URLs first).

Honest limitations

• Not exhaustive. A subdomain with no certificate history, no public scans, no passive-DNS footprint, and an uncommon name won't be found. Discovery is a best-effort sweep of free public sources, not a guarantee.
• Wildcard certificates hide names. A cert for *.example.com proves subdomains exist without naming them — CT can't reveal what the wildcard covers.
• Wildcard DNS poisons probing. Some domains resolve any hostname (wildcard DNS), which would make wordlist probing "find" hundreds of fake subdomains. The finder guards against this by resolving a random bogus hostname first and skipping probing if it resolves.
• Sitemap-less subdomains get a best-effort homepage-based treatment; deep crawling of every child host is not currently robust.

If you know a subdomain exists and discovery missed it, the practical workaround is auditing it directly as its own domain.