inurl:"/catalog.nsf" intitle:catalog
This will return servers which are running versions of Lotus Domino. The catalog.nsf is the servers DB catalog. It will list all the DB's on the server and sometimes some juicy info too. An attacker can back the url down to the "/catalog.nsf" part if needed.