I’m not going to list every possible combination of Google operators, but keep in mind that you can chain most operators. Let’s say you suspect there are some stray sub-domains, but you aren’t sure what they are. You are, however, aware of “www.”, “dev.” and “shop.”. You can chain multiple “-inurl:” operators to remove all of these known sub-domains from the query, leaving you with a list of any stragglers.