Search web subdomains – Windows


How do I find site subdomains in Windows?

This article is about the Findomain program, which in a few seconds will find the subdomains of the site of interest to you.


The following APIs are currently in use:

Searching in the CertSpotter API…
Searching in the Crtsh database API…
Searching in the Sublist3r API…
Searching in the Threatcrowd API…
Searching in the AnubisDB API…
Searching in the Urlscan.io API…
Searching in the Threatminer API…
Searching in the Archive.org API…

Installing Findomain:

1. Win + r > cmd > Enter
2. Go to the folder with the downloaded program
3. To search for subdomains and print information on the screen, use the -t option, followed by the target domain:

findomain-windows.exe -t example.com

Other commands:

  • To save to a file, use the -o The file name will be created by the domain name to which the .txt extension was added. And with the -u option, you can specify any file name of your choice:
findomain-windows.exe -t example.com -o


findomain-windows.exe -t example.com -u domains.txt
  • Some of the found subdomains have not existed for a long time, so if you are only interested in those subdomains that can be opened (that is, subdomains with an IP address), then use the -r option:
findomain-windows.exe -t example.com -r
  • Search only subdomains with IP address, export data to file with specified name:
findomain-windows.exe -t example.com -r -u subdomains.txt