A penetration tester’s guide to sub-domain enumeration
Great list !Also you can look at the SSL certificate of a page of the doamin and see if many domains appears inside it.And currently if the website uses letsencrypt and need wildcard DNS, you may find hundreds of domains. Fortunately Letsencrypt wildcard certificates come in January