Uses certificate transparency logs (crt.sh) — finds subdomains that have had SSL certs issued.