Subdomains are prefixed namespaces under a main domain — like blog.example.com, api.example.com, or staging.example.com. Large organizations can have dozens or hundreds of them across dev, production, and third-party services.

Discovering all subdomains is critical for security audits. Forgotten or abandoned subdomains often run outdated software with known vulnerabilities, or expose staging environments to the public internet — giving attackers alternative entry points.

This tool uses DNS brute-force enumeration — it checks ~100 common subdomain prefixes (www, api, mail, staging, etc.) against your domain and reports any that resolve to an IP address.