Found in public certificate transparency logs, which record every publicly trusted certificate. Some subdomains may no longer exist.