It queries public Certificate Transparency (CT) logs and DNS aggregation feeds to find legitimate SSL certificates issued for subdomains of the target domain.

It uncovers any subdomain that has ever been issued a public SSL/TLS certificate or listed in public DNS mappings.

Yes, you can filter results in real time and download the entire list as a CSV or plain text file with one click.