Question 1

Discovered Subdomains
            0 Found

Export CSV

Copy List

Subdomain Host
                    Record Type
                    Target IP / CNAME Target
                    Status
                    Action

Enter a root domain above and click "Scan Subdomains" to start discovery.

document.addEventListener('DOMContentLoaded', () => {
    const rootDomainInput = document.getElementById('rootDomainInput');
    const scanBtn = document.getElementById('scanBtn');
    const progressArea = document.getElementById('progressArea');
    const scanStatusText = document.getElementById('scanStatusText');
    const scanProgressPercent = document.getElementById('scanProgressPercent');
    const scanProgressBar = document.getElementById('scanProgressBar');
    const foundBadge = document.getElementById('foundBadge');
    const subdomainTableBody = document.getElementById('subdomainTableBody');
    const exportCsvBtn = document.getElementById('exportCsvBtn');
    const copyListBtn = document.getElementById('copyListBtn');
    const domainQuicks = document.querySelectorAll('.domain-quick');

const commonPrefixes = [
        'www', 'mail', 'api', 'dev', 'staging', 'blog', 'cdn', 'app',
        'portal', 'admin', 'shop', 'store', 'docs', 'vpn', 'cloud',
        'auth', 'm', 'mobile', 'test', 'support', 'help', 'status',
        'beta', 'secure', 'news', 'billing', 'git', 'media', 'files',
        'assets', 'login', 'webmail'
    ];

let foundRecords = [];
    let isScanning = false;

function cleanDomain(val) {
        return val.trim()
            .replace(/^https?:///i, '')
            .replace(//.*$/, '')
            .toLowerCase();
    }

async function probeSubdomain(sub, root) {
        const fqdn = `${sub}.${root}`;
        try {
            const res = await fetch(`https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(fqdn)}&type=A`, {
                headers: { 'Accept': 'application/dns-json' }
            });
            const data = await res.json();
            if (data.Status === 0 && data.Answer && data.Answer.length > 0) {
                const answer = data.Answer[0];
                const type = answer.type === 1 ? 'A' : (answer.type === 5 ? 'CNAME' : 'DNS');
                return {
                    host: fqdn,
                    type: type,
                    target: answer.data,
                    active: true
                };
            }
        } catch(e) {}
        return null;
    }

async function startScan() {
        if (isScanning) return;
        const root = cleanDomain(rootDomainInput.value);
        if (!root) return;

rootDomainInput.value = root;
        isScanning = true;
        foundRecords = [];
        subdomainTableBody.innerHTML = '';
        foundBadge.textContent = '0 Found';
        progressArea.classList.remove('hidden');
        scanBtn.disabled = true;
        scanBtn.classList.add('opacity-50');

const total = commonPrefixes.length;
        let completed = 0;

// Run in batches of 4 for speed and rate-limit friendliness
        const batchSize = 4;
        for (let i = 0; i < total; i += batchSize) {
            const batch = commonPrefixes.slice(i, i + batchSize);
            const promises = batch.map(sub => probeSubdomain(sub, root));
            const results = await Promise.all(promises);

results.forEach(res => {
                if (res) {
                    foundRecords.push(res);
                    appendRow(res);
                }
            });

completed += batch.length;
            const pct = Math.round((completed / total) * 100);
            scanProgressBar.style.width = `${pct}%`;
            scanProgressPercent.textContent = `${pct}%`;
            scanStatusText.textContent = `Probing ${completed} of ${total} hosts...`;
            foundBadge.textContent = `${foundRecords.length} Found`;
        }

isScanning = false;
        scanBtn.disabled = false;
        scanBtn.classList.remove('opacity-50');
        scanStatusText.textContent = `Scan complete! Discovered ${foundRecords.length} live subdomains for ${root}.`;

if (foundRecords.length === 0) {
            subdomainTableBody.innerHTML = `No common subdomains responded to public DNS queries for this root domain.`;
        }
    }

function appendRow(record) {
        const tr = document.createElement('tr');
        tr.className = 'hover:bg-gray-50 transition-colors';
        tr.innerHTML = `

${record.host}

${record.type}
            ${record.target}
            
                ACTIVE

Copy

`;
        subdomainTableBody.appendChild(tr);

tr.querySelector('.copy-host-btn').addEventListener('click', (e) => {
            const host = e.target.getAttribute('data-host');
            navigator.clipboard.writeText(host).then(() => {
                e.target.textContent = 'Copied!';
                setTimeout(() => { e.target.textContent = 'Copy'; }, 1500);
            });
        });
    }

scanBtn.addEventListener('click', startScan);
    rootDomainInput.addEventListener('keypress', (e) => {
        if (e.key === 'Enter') startScan();
    });

domainQuicks.forEach(btn => {
        btn.addEventListener('click', () => {
            rootDomainInput.value = btn.textContent;
            startScan();
        });
    });

copyListBtn.addEventListener('click', () => {
        if (foundRecords.length === 0) return;
        const text = foundRecords.map(r => r.host).join('
');
        navigator.clipboard.writeText(text).then(() => {
            copyListBtn.textContent = 'Copied!';
            setTimeout(() => { copyListBtn.textContent = 'Copy List'; }, 1500);
        });
    });

exportCsvBtn.addEventListener('click', () => {
        if (foundRecords.length === 0) return;
        let csv = 'Subdomain,Type,Target
';
        foundRecords.forEach(r => {
            csv += `"${r.host}","${r.type}","${r.target}"
`;
        });
        const blob = new Blob([csv], { type: 'text/csv' });
        const a = document.createElement('a');
        a.href = URL.createObjectURL(blob);
        a.download = `subdomains-${rootDomainInput.value}.csv`;
        a.click();
    });

// Auto-trigger on initial load
    startScan();
});

What is the Online Subdomain Finder & Host Enumerator?
        The Online Subdomain Finder & Host Enumerator is a browser-based DNS reconnaissance and webmaster utility. It probes the most common high-value subdomains (such as api, dev, staging, mail, shop, and cdn) using encrypted DNS-over-HTTPS (DoH) queries to uncover active subdomains, canonical aliases, and target server IP addresses without requiring command-line tools like sublist3r or amass.

Key Capabilities & Features

Encrypted Cloudflare DoH Probing

Accepted Answer

Resolves records directly via Cloudflare's public DNS-over-HTTPS protocol for lightning-fast and private queries.

Question 2

A & CNAME Target Extraction

Accepted Answer

Reveals whether a subdomain resolves directly to an IPv4 address or points to an external CDN/cloud host via CNAME.

Question 3

One-Click CSV & TXT Export

Accepted Answer

Easily export all discovered active hostnames for technical SEO audits or security mapping.

Question 4

Zero Backend Dependency

Accepted Answer

Executes 100% in the user's browser with zero API subscription costs or server footprint.

Subdomain Finder & Host Enumerator

Discovered Subdomains

What is the Online Subdomain Finder & Host Enumerator?

Key Capabilities & Features

Encrypted Cloudflare DoH Probing

A & CNAME Target Extraction

One-Click CSV & TXT Export

Zero Backend Dependency

Why Subdomain Discovery Matters for SEO

Frequently Asked Questions (FAQ)