Subdomains often expose forgotten staging servers, old admin panels and misconfigured services. Whether you're a bug bounty hunter, a sysadmin auditing your own domain, or an SEO checking site structure, the first step is knowing which subdomains exist.

Why subdomain enumeration matters

• Security: forgotten subdomains are a common source of takeovers and leaks.
• Asset inventory: teams often don't know everything they've deployed.
• SEO: duplicate or stale subdomains can split your search rankings.

Method 1: Use a free online tool

The fastest way is a browser-based tool like Manamil Subdomain Finder:

1. Open the tool and type the domain (e.g. example.com).
2. Run the search.
3. Review the results: each subdomain shows whether it's live, its IP address, hosting country and first-seen date.

The live-status column is the useful part: you can immediately focus on the subdomains that actually respond.

Method 2: Command-line tools

If you prefer the terminal, tools like subfinder and amass are popular open-source options. They're powerful but need installation and setup.

What to do with the results

• Check dead subdomains whose DNS still points somewhere (takeover risk).
• Run an SSL check on live ones.
• Look up ownership with a WHOIS lookup and verify records with a DNS checker.
• Remove or redirect anything you no longer use.

Only scan what you're allowed to

Enumerate your own domains or targets within a bug bounty program's scope.

Got a favourite recon workflow? Share it in the comments.