Passive discovery
Find subdomains of any domain.
Search public passive sources for hostnames previously observed under a domain. No active scanning, account, or API key.
Discovered subdomains
Hostname
Passive results may be historical or inactive. SubScout does not resolve, probe, or contact discovered hosts.
Common questions
How can I find the subdomains of a website?
Enter a domain or URL above. SubScout normalizes it to the registrable domain and checks passive public sources for previously observed subdomains.
Is SubScout free, and does it require an account?
SubScout is free, non-profit, and has no user accounts, advertisements, or analytics trackers.
Does SubScout actively scan the target?
No. It never brute-forces DNS, probes HTTP services, scans ports, or contacts discovered subdomains.
Are discovered hostnames guaranteed to be active?
No. Results can contain historical entries and may be incomplete.