crt.sh

subdomain finder one liner accepts file or raw input as well as piped input from stdin. can also feed other tools like url2cidr to find the ip block a subdomain belongs to and the owner of that ip space