Take it like a gift
Censys subdomain finder
Perform subdomain enumeration using the certificate transparency logs from Censys.
bettercap
The Swiss Army knife for WiFi, BLE, IPv4 and IPv6 networks reconnaissance and MITM attacks.