Quick subdomain discovery via common wordlist + DNS-over-HTTPS. Rate-limited to ~250 req/min by Cloudflare DNS. For full scans, use tools like subfinder or amass locally.