Find every subdomain
of a domain.

Every hostname under a domain that ever appeared in a public TLS certificate — with certificate counts, first/last seen and live DNS status.

13 hosts · 304 ms

HostCertsFirst seenLast seenDNS
htb.co.uk 36 2026-04-10 2026-10-04 ok
*.htb.co.uk 24 2026-05-16 2026-09-14 —
oa.htb.co.uk 1 2025-11-27 2025-11-27 nodata
sync.htb.co.uk 1 2025-11-27 2025-11-27 nodata
mail.htb.co.uk 1 2025-11-27 2025-11-27 nodata
webmail.htb.co.uk 1 2025-11-27 2025-11-27 nodata
imap.htb.co.uk 1 2025-11-27 2025-11-27 nodata
pop.htb.co.uk 1 2025-11-27 2025-11-27 nodata
autodiscover.htb.co.uk 1 2025-11-27 2025-11-27 ok
updates.htb.co.uk 8 2026-04-14 2026-08-10 ok
communications.htb.co.uk 13 2026-04-09 2026-10-04 ok
mta-sts.htb.co.uk 12 2026-04-10 2026-10-04 ok
relay.htb.co.uk 1 2025-11-27 2025-11-27 nodata

Programmatic access, with DNS A records: API GET /v1/hosts/htb.co.uk (API key for paging).

Shown here: hostnames with a certificate that is valid now or expired within the last 90 days. The full history since 2013 — hostnames whose last certificate expired earlier — is a Pro plan method: GET /v1/hosts-history/htb.co.uk.