Does anyone know how they actually find all these instances to exploit? For instance say your instance is attached to a subdomain, how would they find it? or sa

Does anyone know how they actually find all these instances to exploit? For instance say your instance is attached to a subdomain, how would they find it? or say your instance is running in a port other than 80, how would they find it as well?