assetfinder

assetfinder --subs-only <domain>

TomNomNom's tool for finding subdomains and associated domains using public sources.

To get a quick list of subdomains and also other domains belonging to the same organization (e.g., example.net, example.org). It's ideal in combination with subfinder for a broader view. I use it when I want to map a company's entire internet presence.

It doesn't resolve IPs or perform active checks. If you need more depth, prefer amass or active tools.