Rating: 4.5
search for name of subdomain in Certificate Transparency logs, then use Wayback machine to get flag
I don't remember