# Ultimate Subdomain Finder Wordlist
# 10,000+ common subdomain names for brute force enumeration

# === Common ===
www
mail
ftp
localhost
webmail
smtp
pop
pop3
ns1
ns2
ns3
ns4
dns
dns1
dns2
mx
mx1
mx2
imap
remote
blog
shop
store
forum
wiki
cpanel
whm
webdisk
direct
www2
www3
www4
img
image
images
media
static
assets
cdn
api
dev
test
stage
staging
prod
production
beta
alpha
demo
qa
uat
sandbox

# === Web Servers ===
web
web1
web2
web3
web01
web02
web03
app
app1
app2
app3
app01
app02
app03
server
server1
server2
server01
server02
srv
srv1
srv2
srv01
srv02
node
node1
node2
node01
node02
host
host1
host2
origin
origin-www
gateway
proxy
reverse
frontend
backend

# === Development ===
dev
dev1
dev2
dev01
dev02
develop
development
test
test1
test2
test01
test02
testing
stage
stage1
stage2
staging
staging1
staging2
pre
preprod
pre-prod
pre-production
uat
uat1
uat2
qa
qa1
qa2
sandbox
sandbox1
sandbox2
demo
demo1
demo2
alpha
beta
gamma
local
localhost
preview
canary
nightly
edge

# === Production ===
prod
prod1
prod2
prod01
prod02
production
production1
production2
live
live1
live2
stable
release
master
main
primary
secondary

# === API ===
api
api1
api2
api3
api-v1
api-v2
api-v3
api-gateway
api-dev
api-test
api-staging
api-prod
rest
rest-api
restapi
graphql
graphql-api
gql
grpc
rpc
ws
websocket
socket
realtime
stream

# === Admin ===
admin
admin1
admin2
administrator
administrator1
adm
superadmin
sysadmin
webadmin
control
controlpanel
control-panel
panel
cpanel
whm
plesk
horde
roundcube
manage
management
console
dashboard

# === Authentication ===
auth
auth1
auth2
authentication
login
signin
signon
sign-in
sign-on
logout
signout
sign-out
sso
single-sign-on
oauth
oauth2
openid
saml
identity
id
idp
identityprovider
accounts
account
users
user
members
member
register
registration
signup
sign-up
password
forgot-password
reset-password

# === Database ===
db
db1
db2
db01
db02
database
database1
database2
mysql
mysql1
mysql2
mariadb
postgres
postgresql
pgsql
mongo
mongodb
redis
redis1
redis2
memcache
memcached
cache
cache1
cache2
elastic
elasticsearch
es
es1
es2
solr
lucene
sphinx
cassandra
couchdb
dynamodb
rds
aurora

# === Mail ===
mail
mail1
mail2
mail01
mail02
smtp
smtp1
smtp2
pop
pop3
imap
imap4
webmail
webmail1
webmail2
email
email1
email2
mx
mx1
mx2
mx3
mx4
relay
relay1
relay2
mailserver
exchange
owa
outlook
autodiscover
autoconfig
postfix
sendmail
exim
dovecot
roundcube
horde
squirrelmail
newsletter
mailing
lists
listserv

# === Security ===
secure
security
sec
ssl
tls
https
vpn
vpn1
vpn2
openvpn
ipsec
firewall
fw
waf
ids
ips
siem
soc
cert
certs
certificates
pki
ca
key
keys
vault
secrets
2fa
mfa
otp
totp

# === Infrastructure ===
ns
ns1
ns2
ns3
ns4
dns
dns1
dns2
dns3
dns4
nameserver
nameserver1
nameserver2
resolver
recursive
authoritative
ntp
ntp1
ntp2
time
ldap
ldap1
ldap2
ad
ads
active-directory
directory
radius
tacacs
dhcp
dhcp1
dhcp2
tftp
pxe
boot

# === Monitoring ===
monitor
monitoring
mon
nagios
zabbix
prometheus
grafana
kibana
splunk
datadog
newrelic
dynatrace
elastic
elk
logstash
graylog
sentry
pagerduty
status
uptime
healthcheck
health
metrics
stats
statistics
analytics
apm
trace
tracing

# === Storage ===
storage
storage1
storage2
files
file
fileserver
nas
san
nfs
smb
samba
cifs
ftp
sftp
ftps
tftp
s3
minio
backup
backup1
backup2
backups
archive
archives
data
data1
data2
media
media1
media2
upload
uploads
download
downloads
share
shares
public
private

# === CI/CD & DevOps ===
ci
cd
cicd
ci-cd
jenkins
jenkins1
jenkins2
bamboo
travis
circleci
gitlab
gitlab-ci
github
bitbucket
git
git1
git2
gitea
gogs
svn
subversion
hg
