Very quick and simple subdomain enumeration using http://crt.sh.
https://github.com/mathis2001/Cert4Recon