I'm surprised nobody mentioned subfinder yet: https://github.com/projectdiscovery/subfinder https://github.com/projectdiscovery/subfinder Subfinder uses differ

I'm surprised nobody mentioned subfinder yet: https://github.com/projectdiscovery/subfinder https://github.com/projectdiscovery/subfinder Subfinder uses different public and private sources to discover subdomains. Certificate Transparency logs are a great source, but it also has some other options.