Passive subdomain & host discovery (crt.sh, OTX, Wayback, Shodan InternetDB) with DNS resolution and exposure data.