// dns · subdomains
ntu.edu.sg Subdomain Discovery
Discover subdomains of ntu.edu.sg by searching Certificate Transparency (CT) logs. This passive reconnaissance technique finds subdomains that have had SSL/TLS certificates issued for them.
//01
ntu.edu.sg Subdomains from CT Logs
Certificate Transparency logs are public, append-only databases of all SSL/TLS certificates issued by participating Certificate Authorities. By searching these logs for ntu.edu.sg, we can discover subdomains that have had certificates issued for them.
This approach is passive, it doesn't send any traffic to ntu.edu.sg's servers. It only queries the public crt.sh database, making it safe and non-intrusive.
//02
How Subdomain Discovery Works for ntu.edu.sg
When a Certificate Authority issues an SSL/TLS certificate for any subdomain of ntu.edu.sg, the certificate details are recorded in Certificate Transparency logs. These logs are publicly searchable.
By querying crt.sh for %.ntu.edu.sg, we find all certificates ever issued for ntu.edu.sg and its subdomains. The name_value fields from these certificates reveal subdomain names that may not be discoverable through other means.
//03
Using ntu.edu.sg's Subdomain Data
Discovered subdomains of ntu.edu.sg can help identify forgotten services, development environments, or unauthorized infrastructure. Domain administrators should regularly audit their subdomain footprint.
Note that CT log discovery only finds subdomains that have had SSL/TLS certificates issued. Subdomains using only HTTP or internal DNS records without certificates will not appear in these results.