Your internal hostnames are in the CT logs if you issued public certs for private services. Every major company does it. The data is searchable, public, and has been there for years. See Kenton McDonough @ PasswordsCon during #BSidesLV on Wed Aug 5 @ 12:00.