- APKMirrorSource searches APK metadata pages for key patterns - CrtShSource discovers subdomains via CT logs and probes config endpoints - Both credentialless, emit findings on ciLogKeyPattern match