Finding Hidden Internal Apps Through Public Certificate Logs (naveensrinivasan.com)

CT logs can be a gold mine for new domains and to map internal infrastructure... I do think that for internal domains, a wildcard domain is the way to go.