We dig through public certificate transparency logs to surface subdomains most people never see.
Where does this come from?
Certificate authorities log every certificate they issue to public transparency logs. If a subdomain ever got a certificate, it is listed here — data courtesy of crt.sh. Results are limited to 500.