Find hidden subdomains The hosts an organization forgot about are the ones worth finding, and most of them announced themselves the moment someone requested a TLS certificate. Certificate Transparency turns that into a searchable, permanent, historical index — free and completely passive. The beginner's mistake is treating a CT hit as a live host: most of what you pull back does not resolve, and that is information too, not noise. Which source first | You hold | Start with | Why | |---|---|---| | An apex domain | crt.sh wildcard query | Broadest free coverage, includes long-dead names | | A d…