crt.sh Handy tool to find and probe subdomains from crt.sh Depends on jq and httprobe Use as crtsh example.com or crtsh domains_list.txt. Results will be at domains_crt.txt