Search Certificate Transparency logs (crt.sh) for every cert issued for a domain: find forgotten subdomains.