SUBDOMAIN FINDER
Passive subdomain enumeration from public Certificate Transparency logs (crt.sh). No scanning, no packets sent to the target — just what CAs have already published.
Rate limited to 10 lookups per minute. Only your own domains, please.