CheckVibeCodeCheckVibeCode
Checks/Infrastructure
InfrastructureLive2 checks

Subdomain Enumeration Scanner

Discover subdomains via certificate-transparency logs and a common-name wordlist, and flag any pointing at an unclaimed third-party service.

Run this scanSee pricing

How this scan works

  • Queries certificate-transparency logs (crt.sh) for every hostname that has ever had a public TLS certificate issued under your domain — including hosts you forgot existed
  • Probes a built-in wordlist of the names that most often exist without a public certificate: www, api, staging, dev, admin, app, beta, test, cdn, mail, portal, dashboard
  • Resolves up to 60 candidates over DNS to separate names that merely appear in a log from hosts that are actually live today
  • Checks every resolved host's CNAME against known subdomain-takeover fingerprints — a record still pointing at a deprovisioned S3 bucket, Heroku app, or Netlify/GitHub Pages site can be re-claimed by anyone, who then serves their content on your domain and your cookies
  • Kept to one HTTP call plus a bounded batch of DNS lookups so it fits the standard scan budget. Port-scanning each discovered host is heavier and runs in Deep Scan instead

More checks in Infrastructure

DNS & Email Security ScannerDDoS Protection ScannerMobile API Rate Limiting ScannerDomain Hijacking DetectionVercel Hosting Security ScannerNetlify Hosting Security Scanner