Certificate search.
Replace offsec.nl
with the target domain.
$ curl -s https://crt.sh/\?q\=offsec.nl\&output\=json | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u
cyberchef.offsec.nl
dork.offsec.nl
dorks.offsec.nl
googledorks.offsec.nl
kb.offsec.nl
lock.offsec.nl
mha.offsec.nl
msportals.offsec.nl
offsec.nl
pw.offsec.nl
saf.offsec.nl
temp.offsec.nl
temp2.offsec.nl
test.offsec.nl