Discover a domain's subdomains from public Certificate Transparency logs (crt.sh, with a Cert Spotter fallback) — great for spotting forgotten or shadow-IT hosts.