Subdomain finder and DNS map
Everything public sources say about a domain, drawn as one map: its records, the subdomains certificates reveal, the addresses behind them and who runs those addresses.
For cybersecurity research only
Use this map to assess your own exposure, or that of a domain you have a legitimate research reason to study. Never use it to prepare an attack, or to watch or harass an organisation or a person.
Reading DNS, certificate logs and routing data. Large domains can take up to half a minute.
Questions
Where does the map come from?
Only public sources: DNS answers from a public resolver, the certificate transparency logs (crt.sh), where every certificate issued for a name is published, and RIPEstat routing data, which says which network announces an address. Nothing is guessed and nothing is scanned.
What does it not do?
It does not scan ports, read banners or web pages, try a zone transfer or guess subdomain names, and it never connects to the hosts it finds. For open ports, technologies and vulnerabilities on your own domains, Perimetry Cloud runs those checks once you prove ownership.
Why only two domains a day?
The map is for research on a few domains, not for surveying many. Each network can map two different domains per 24 hours; a domain it has already mapped can be opened again as often as needed.
Do you store anything?
The map of a domain is kept one hour (five minutes when the certificate logs did not answer), so the same domain is not queried again and again, then forgotten. To apply the limit we keep, for 24 hours, a keyed hash of your network and of the domain, never the address or the domain themselves. No search is linked to a person.