subdomain-enumeration
Map subdomains via crt.sh and subfinder at recon kickoff.