Subdomain Sweep

The main domain is locked down, but a forgotten subdomain never got the memo. Enumerate with your favorite tool, or just check crt.sh for certificate transparency logs — passive recon beats brute force every time.