A penetration tester’s guide to sub-domain enumeration
Great list !<p>Also you can look at the SSL certificate of a page of the doamin and see if many domains appears inside it.<p>And currently if the website uses letsencrypt and need wildcard DNS, you may find hundreds of domains. Fortunately Letsencrypt wildcard certificates come in January