Skip to content
TheAdminStack Practical security engineering
Find a tool/ Get in touch

OSINT · Subdomain Intelligence · PKI

Subdomain Recon

Discover every subdomain that has appeared in public Certificate Transparency logs, then scan the domain for takeover risk — CNAME chains, NS and SERVFAIL lame delegations, wildcard zones and dangling records fingerprinted against 100+ cloud services.

CT Log Query Subdomain Enum Wildcard & Expiry Flags CNAME Chain Analysis NS + SERVFAIL Detection 100+ Service Fingerprints Risk Scoring CSV / JSON / Markdown

What CT discovery helps you investigate

Attack Surface Mapping

Enumerate every subdomain that has ever had a certificate issued — including staging, dev, and internal-facing hosts that may not appear in DNS. Ideal for external recon and pre-engagement reconnaissance.

Shadow IT Discovery

Surface subdomains that IT didn't know existed. Wildcard certificates, third-party SaaS integrations, and forgotten test environments all leave traces in CT logs that CertScout surfaces instantly.

Certificate Inventory Audit

Validate that your certificate posture matches expectations. Spot wildcard certs, unexpected issuers, expiring certificates, or certificates issued for hosts that should not be public-facing.

Blue Team Validation

Confirm which certificates have been issued for your organisation's domains. Detect unauthorised issuance events and verify your CA configuration is enforced — without trusting CAA records alone.

Subdomain Takeover Prep

Export the full subdomain list as CSV or copy it to clipboard, then pipe directly into tools like Subjack, can-i-take-over-xyz, or hit Check for takeover to run the Takeover tab against the same domain.

Transparent & Public Data

Certificate Transparency logs are public by design — every certificate issued by a public CA must be logged. CertScout queries only this public record; no credentials, crawling, or active probing is involved.

Responsible Use: CertScout queries only public Certificate Transparency logs — the same data any browser vendor or CA auditor can access. Use this tool for legitimate security research, asset inventory, and defensive intelligence. Do not use it for unauthorised reconnaissance or harassment. Lookups are subject to rate limits. No query data is stored — only anonymised usage metrics.

How the Takeover scan works

A four-phase enumeration and detection pipeline — all client-side, no proxy, no API keys required.

Phase 1 — Multi-Source Enumeration

Queries six passive sources in parallel: crt.sh Certificate Transparency logs, HackerTarget passive DNS, AlienVault OTX threat intelligence, RapidDNS, CertSpotter CT, and Anubis-DB. Results are deduplicated and normalised before scanning begins.

Phase 2a — Wildcard DNS Detection

Before resolving anything, Takeover queries a guaranteed-nonexistent subdomain via DoH. If it resolves, the domain has wildcard DNS — a banner warns you that results may include false positives throughout the scan.

Phase 2b — CNAME Chain + NS Resolution

Full CNAME chains are followed (up to 10 hops) via DNS-over-HTTPS. Each subdomain is also checked for NS delegation — dangling NS records pointing to non-existent nameservers, or delegations that return SERVFAIL (a lame delegation), indicate a separate, severe class of takeover.

Phase 2c — A-Record NXDOMAIN

After the full CNAME chain is resolved, the terminal target's A record is queried. An NXDOMAIN response on the final target — even without a fingerprint match — is a strong takeover signal and is flagged as Potential.

Phase 3 — HTTP Fingerprint Verification

Each CNAME match is checked against 100+ service signatures (GitHub Pages, Heroku, S3, Azure, Netlify, Vercel, Railway, Fly.io, Zendesk, Shopify and more). An HTTP fetch attempts to confirm the dangling error page in the response body.

Status Classification & Risk Scoring

Every fingerprint is classified vulnerable, edge-case, or not-vulnerable, so services like CloudFront or WordPress.com don't raise false alarms. Each finding also gets a 0–100 risk score and concrete remediation guidance, exportable as Markdown, JSON, or CSV.

Concurrent & Configurable

Choose between 5, 10, or 20 concurrent checks. All requests originate from your browser — no data passes through TheAdminStack servers. CORS restrictions apply to HTTP body verification; use the JSON/CSV export with curl to confirm findings.

Responsible Use: Takeover is designed for legitimate security research, bug bounty programmes, red team engagements, and defensive vulnerability assessment of infrastructure you own or have explicit written permission to test. Unauthorised reconnaissance of third-party domains may violate computer fraud laws in your jurisdiction. Use responsibly and in accordance with applicable laws.

Frequently asked questions

What does Subdomain Recon do?

It combines two steps of external attack-surface review. The CT discovery tab searches public Certificate Transparency logs for every certificate issued for a domain and returns a deduplicated subdomain inventory. The Takeover scan tab enumerates subdomains from six passive sources, resolves their DNS and fingerprints dangling records that could be taken over.

What is Certificate Transparency and why search it?

Certificate Transparency (CT) is a public, append-only log of every SSL/TLS certificate issued by trusted authorities. Because certificates list their domains and subdomains, searching CT logs is one of the fastest passive ways to enumerate an organisation's subdomains and spot newly issued or expiring certificates — with no scanning of the target itself.

What is a subdomain takeover?

A subdomain takeover happens when a DNS record (usually a CNAME) still points to a third-party service — like a deprovisioned cloud bucket, CDN, or SaaS app — that no longer claims that hostname. An attacker can re-register the service resource and serve content from your subdomain. The Takeover scan fingerprints those dangling records against 100+ known services, each classified as vulnerable, edge-case, or not-vulnerable.

How is the CT discovery tab different from crt.sh?

It queries the same Certificate Transparency data as crt.sh but returns a deduplicated, sorted subdomain inventory with wildcard flags, expiry markers, and one-click CSV export — instead of crt.sh's raw, repetitive certificate rows.

Is Subdomain Recon free and safe to use?

Yes. It is free with no account or API key needed, and performs only passive enumeration and read-only DNS/HTTP fingerprinting — it does not exploit or claim any resource. Use it on domains you own or are authorised to test.

SquatWatch → Domain typosquat & lookalike scanner NetRecon → IP, domain & ASN threat intelligence TenantRecon → Microsoft 365 / Azure AD attack surface