Subdomains
discover subdomains via crt.sh, dns bruteforce and search engines