Use the Subdomainscanner_v0.8_beta.exe tool to find:
Subdomainscanner_v0.8_beta.exe is a sub-domain lookup tool that allows you to find all subdomains of the input domain name.
In the "Input Domain name" field, enter the domain name you want to find, in the query engine select Baidu, click "Search"
It will come out in about a few minutes.
The result will show that the subdomain name under the input domain name will also give the corresponding IP address.
The format displays content in the output box.
To save the results of the search can be directly "export", click on the file-export options, as needed to export the results, the default export path is in your installation directory, will export a txt text.
The content of the search is still relatively complete,
However, sometimes there will be missed cases, you can manually search again.
You can also use the tool to scan all IP addresses of the network segment for inspection.
Many of these tools can be found on webmaster tools.
Sub-domain Lookup