We all know about the famous spyse.com this python3 scripts scrounges subdomains without the api. There is an option of getting the api, in fact that's what I recommend using the api they provide. Because this methods below may not bring out all subdomains as the api can and perhaps the portability also.
https://www.nmmapper.com/sys/tools/subdomainfinder/
https://www.nmmapper.com/kalitools/theharvester/email-harvester-tool/online/
https://www.nmmapper.com/st/networkmapper/nmap/online-port...