Subfinder

Subfinder is a free, fast tool that hunts down a website's subdomains by checking dozens of public sources at once, so you don't have to query each one by hand.

Why it matters

It rolls the certificate logs, public records, and common guesses into a single command. Point it at a domain, get back a list of its subdomains.

When to reach for it

When the free crt.sh look isn't enough and you want broader coverage of a company's hidden pages.

Worth knowing

A name existing doesn't mean the page is live. Always do a quick check afterward to keep only the ones that actually respond.