Subdomain Discovery Tool
Discover subdomains to ensure that your entire external attack surface is mapped and secured.
What this tool checks
- DNS records
- Certificate Transparency Logs
- Public data sources
- Live subdomain resolution
Every source an attacker would use, in one scan.
What it is
Know your external attack surface area
Most breaches don't start with a zero-day. They start with a forgotten or misconfigured asset no one was watching. Subdomains are a common way in. Once an attacker reaches one, they can read cookies set on your root domain, plant cross-site scripting, or slip past your security policies. Mapping every subdomain you expose is how you close those gaps before someone finds them.
How it works
How does subdomain discovery work?
DNS providers are the authoritative source for your subdomains, but many are also exposed through public data. Certificate Transparency Logs are a common one: certificate authorities publish a record every time they issue a TLS certificate. These sources won't reveal everything, but they show what anyone can find without any special access. HostedScan pulls from these public sources automatically, so you see your exposure the same way an attacker would.
Where subdomains surface
- 1DNS recordsAuthoritative source
- 2Certificate Transparency LogsPublic record of every TLS cert issued
- 3Public data sourcesWhat anyone can find, no access needed
Our Customers
5,000+ MSPs and IT teams who move faster
Speed and power,
without the complexity
The world's leading vulnerability scanners, all in one platform.