What it is
Finds subdomains through public Certificate Transparency logs, via crt.sh. Every certificate a CA issues is logged publicly, so any hostname anyone has ever requested a certificate for ends up on record. Any address on the domain works, so www.example.com and shop.example.com both list every subdomain of example.com.
Why it matters
Subdomains are where the forgotten things live: staging servers, admin panels, old campaign sites, a dashboard somebody stood up for a demo and never took down. They tend to be maintained to a lower standard than the main site. CT logs are historical, though, so expect a good share of what turns up no longer to resolve.
How this assessment works
Skopeon Labs queries public infrastructure signals and authoritative network protocols directly from external sensor nodes. All evaluations are completely non-invasive and agentless, assessing observable configurations without sending malicious payloads or disrupting service.
Operational Scope & Limitations
This check evaluates public perimeter responses observable at the time of inquiry. Endpoints protected behind third-party reverse proxies or CDNs reflect the edge configuration of the proxy layer.