How to Find Hidden Subdomains (And Why Hackers Love Them)
When you visit a website like example.com, you are entering through the front door. But most websites have side doors, back doors, and secret basements that the public isn't supposed to see.
These are called Subdomains.
While standard subdomains like https://www.google.com/search?q=blog.example.com or https://www.google.com/search?q=shop.example.com are public, many companies create "hidden" subdomains for testing, employee logins, or development. Finding these can reveal a competitor's future plans or help you secure your own digital footprint.
Here is how to use
What is a Subdomain?
A subdomain is the prefix before the main domain name. It creates a completely separate "bucket" of content.
- Root Domain:
findinfo.io - Subdomain:
blog.findinfo.io
Why Do People "Hide" Them?
Developers often create subdomains that aren't linked on the homepage. Common examples include:
https://www.google.com/search?q=dev.company.com(A testing site where new features are built).https://www.google.com/search?q=staging.company.com(A copy of the live site used for final checks).https://www.google.com/search?q=admin.company.com(Employee-only login pages).
For a hacker (or a curious competitor), finding a dev subdomain is like finding a key under the doormat. These test sites often have weaker security than the main site.
How to Find Them Using DNS Records
While you can't simply "list" all subdomains without a dedicated scanner, public DNS records often leak their existence.
1. Check CNAME Records
Go to the https://www.google.com/search?q=support.zendesk.com or https://www.google.com/search?q=shops.myshopify.com). These records publicly reveal that https://www.google.com/search?q=support.company.com and https://www.google.com/search?q=shop.company.com exist.
2. Check SSL Certificates (The "CRT" Method)
When a company buys an SSL certificate (to get the "HTTPS" padlock), they often buy a "Wildcard Certificate" (*https://www.google.com/search?q=.company.com) or list multiple subdomains on one certificate. These certificates are public records.
While our DNS tool focuses on the current live records, knowing that these "Certificate Transparency" logs exist helps you understand that nothing on the web is truly hidden.
Conclusion
If you are a business owner, remember: "Security by Obscurity" (hoping no one guesses your URL) is not real security. If a subdomain exists, someone can find it.
Want to check your visible DNS records?
