Subdomain Finder
Find known subdomains for any domain using public records and databases. Useful for security reviews, research, and domain inventory. Get a clean list you can act on.
Two-step verification: 1) Discovers candidate subdomains from crt.sh Certificate Transparency logs. 2) Verifies each one via real DNS lookup (Cloudflare 1.1.1.1) to filter out expired/decommissioned subdomains. Only LIVE
Automate Web Data Extraction FastUse Thunderbit’s Chrome extension to scrape websites and extract structured data in a couple of clicks. Pull details from subpages, PDFs, docs, and images, then export to Sheets, Airtable, or Notion.
Install fromChrome Web Store
Automate Web Data Extraction Fast
Thunderbit helps you scrape data from websites while you browse, using AI Suggest Fields to detect the right columns and extract structured information. Collect data from listings, directories, and results pages, then enrich it with subpage scraping across profiles, detail pages, PDFs, docs, and images.
Clean up your output with AI-powered summarizing, categorizing, and formatting, then export to Google Sheets, Airtable, or Notion. Use pagination support and scheduled scraping to keep datasets updated with minimal manual work.
How to Find Subdomains Using Thunderbit
STEP 1Download and InstallDownload and install the Thunderbit Chrome Extension from the Thunderbit Chrome Extension Download Page. Once installed, log in or create a free account to get started.
STEP 2Open ExtensionOpen Chrome and click the Thunderbit extension icon to launch Thunderbit. In the tool list, select the "Subdomain Finder" and open the "Find subdomains" tab. In the Domain field, enter a root domain in standard format (for example, example.com) without http:// or https://. Optionally, set Search depth to shallow, standard, or deep based on how exhaustive you want the scan to be, and choose Include details to return either subdomains only or subdomains with IP address and discovery source when available.
STEP 3Click the Find subdomains ButtonClick the "Find subdomains" button to start the scan. Thunderbit will query public records and databases and return results in a table with columns such as Subdomain, IP Address, and Discovery Source (depending on your detail setting). Review the table, then export the results to Excel, Google Sheets, Airtable, or Notion, or download as CSV or JSON from the export options.
Learn how to find subdomains for any root domain
Discover subdomains from public sources
Subdomain Finder helps you enumerate known subdomains tied to a root domain by checking public records and databases such as certificate transparency logs and passive DNS sources. Enter a domain like example.com, choose a search depth, and get a structured list of hostnames that may represent apps, portals, APIs, or staging environments. It’s built for security teams, IT admins, and researchers who need visibility beyond the main website.
Enrich results with IP and source context
When you enable details, the tool returns each discovered subdomain alongside an IP address and a discovery source label when available. This added context helps you validate findings, prioritize what to review, and understand where each record came from. If you only need a clean hostname list, you can switch to subdomain-only mode while keeping the same table structure for consistent downstream handling.
Support security assessments and attack surface reviews
Use Subdomain Finder to map external-facing assets during reconnaissance, vulnerability triage, and routine security audits. Teams can identify forgotten staging sites, legacy admin panels, or newly issued certificates that reveal additional services. The depth setting lets you balance speed and coverage, making it useful for quick checks during incident response as well as deeper periodic reviews of a company’s public footprint.
Improve domain management and operational research
Operations and engineering teams can use the output to maintain an inventory of active hostnames, verify DNS hygiene, and spot inconsistencies across environments. Researchers can compare subdomain lists over time to track infrastructure changes or monitor brand exposure. Because results are returned as a table with consistent columns, it’s easy to copy into spreadsheets, share with stakeholders, or feed into internal documentation workflows.
Discover More Free Tools
Cold Email Template Generator
Create personalized cold email templates with a subject line and ready-to-send body. Tailor outreach by role, company, and purpose to improve reply rates.
CSV to Excel Converter
Convert CSV files into XLS or XLSX in one quick step. Keep rows, columns, and values intact for clean spreadsheet work.
Pinteres Scraper
Scrape public boards for image URLs, titles, and metadata in a structured list. Save time with clean exports for analysis or archiving.
Job Description Generator
Create polished job descriptions from role details to keep postings consistent and hiring faster.
Cron Expression Generator
Create valid cron expressions for task scheduling with a simple interface. Save time and reduce errors with clear, ready-to-use output.
AI Sales Email Generator
Create personalized sales emails in seconds with the free AI Sales Email Generator. Perfect for sales teams and entrepreneurs. Try it now and boost your outreach with Thunderbit’s suite of AI tools.
Summary Generator
Generate concise summaries from long articles, condensing content into a clear paragraph under 100 words for quick understanding.
YouTube Transcript Extractor
Extract video transcripts from a URL and get clean, readable text with timestamps. Copy or download subtitles for notes, research, and content review.
Find More Tools Now
What users say about Thunderbit
Taryn W.Growth Strategist@Thunderbit changed how I run competitor research. I click 'AI Suggest Fields,' and it builds a clean table across paginated results—no coding, no CSS. Huge time-saver when analyzing product data from long-tail marketplaces.
Miles T.Sales Development ConsultantI use Thunderbit to grab emails and phone numbers from directories. It extracts clean contact info in one click, and exporting to Sheets or Notion takes seconds. No extra setup, no coding—just usable data ready to work with.
Rhea C.E-commerce AnalystThunderbit helps me monitor SKU data across multiple pages. I scrape the listings, then use Subpage Scraping to pull full product specs, pricing, reviews, and stock. The AI organizes everything into columns I define.
Cassian B.Real Estate AdvisorThunderbit's Scheduled Scraper makes real estate tracking easier. I describe the interval in plain English, and it automatically pulls updated listings, prices, and links without touching the setup again. Simple and very practical.
Dorian B.Content & SEO SpecialistI use Thunderbit's Field AI Prompts to clean and tag scraped blog content. It extracts titles, authors, and even suggests categories. Works great across dynamic sites and subpages—perfect for building structured SEO datasets.
Lina K.Marketplace Operations LeadWe track SKUs from niche stores using Thunderbit. Cloud Scraping handles 50 pages at a time, and for login-required sites, we switch to browser mode. It’s fast, flexible, and doesn’t need ongoing maintenance or manual edits.
Jorge F.Inbound Sales ManagerThunderbit’s AI Autofill is a lifesaver. After scraping contact info, I use it to fill lead forms directly in my browser. I just select the tab, and it fills everything using the scraped row. No manual input needed.
Alina D.Freelance ResearcherI rely on Thunderbit for extracting data from PDFs, image-based sites, and infinite scroll pages. It handles messy formats with AI and delivers ready-to-export tables I can send to Google Sheets or Airtable in seconds.
Taryn W.Growth Strategist@Thunderbit changed how I run competitor research. I click 'AI Suggest Fields,' and it builds a clean table across paginated results—no coding, no CSS. Huge time-saver when analyzing product data from long-tail marketplaces.
Miles T.Sales Development ConsultantI use Thunderbit to grab emails and phone numbers from directories. It extracts clean contact info in one click, and exporting to Sheets or Notion takes seconds. No extra setup, no coding—just usable data ready to work with.
Rhea C.E-commerce AnalystThunderbit helps me monitor SKU data across multiple pages. I scrape the listings, then use Subpage Scraping to pull full product specs, pricing, reviews, and stock. The AI organizes everything into columns I define.
Cassian B.Real Estate AdvisorThunderbit's Scheduled Scraper makes real estate tracking easier. I describe the interval in plain English, and it automatically pulls updated listings, prices, and links without touching the setup again. Simple and very practical.
Dorian B.Content & SEO SpecialistI use Thunderbit's Field AI Prompts to clean and tag scraped blog content. It extracts titles, authors, and even suggests categories. Works great across dynamic sites and subpages—perfect for building structured SEO datasets.
Lina K.Marketplace Operations LeadWe track SKUs from niche stores using Thunderbit. Cloud Scraping handles 50 pages at a time, and for login-required sites, we switch to browser mode. It’s fast, flexible, and doesn’t need ongoing maintenance or manual edits.
Jorge F.Inbound Sales ManagerThunderbit’s AI Autofill is a lifesaver. After scraping contact info, I use it to fill lead forms directly in my browser. I just select the tab, and it fills everything using the scraped row. No manual input needed.
Alina D.Freelance ResearcherI rely on Thunderbit for extracting data from PDFs, image-based sites, and infinite scroll pages. It handles messy formats with AI and delivers ready-to-export tables I can send to Google Sheets or Airtable in seconds.