Find all subdomains of a domain with crt.name
Came across this post on X that shared a trick to find all subdomains of a domain. You add your domain in the URL below, visit it in your browser, and it shows you a bunch of subdomains:
https://crt.name/v1/search?apex=YOUR_DOMAIN
Just replace YOUR_DOMAIN with a domain and it lists every subdomain it has on file. The index is pre-built, and as their website explains, the data is assembled from multiple archives. Certificate transparency logs, retired CT logs replayed from the Internet Archive, Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, HaGeZi blocklists, and a prober that checks common hostnames against known apexes.
Since it aggregates so many sources, the results lean toward anything that ever existed for that apex. During my testing, most of the subdomains were either old, dead, or even something that I never set up in the first place.