- Search for copyright strings on Google to find domains
When a subdomain is not resolved, try using it as a virtual host with the main domain
List subject alternative names:
$ openssl s_client -connect example.com:443 | \
openssl x509 -noout -text | \
grep -o 'DNS:[a-z\.]*,'