How to find internal subdomains OSINT

When I'm looking for new target on Hackerone I'm always paying attention to numbers of resolved reports and wonder if…