Passive external enumeration of a company's domain/subdomain infrastructure. Use when asked to enumerate, recon, or map a company's external attack surface. Triggers: "enumerate domains", "subdomain recon", "map infrastructure", "osint on company", "what subdomains does X have", "attack surface", "external recon".