scrounges subdomains without the api from spyse cybersecurity search e
...There is an option of getting the api, in fact that's what I recommend using the api they provide. Because this methods below may not bring out all subdomains as the api can and perhaps the portability also.
https://www.nmmapper.com/sys/tools/subdomainfinder/
https://www.nmmapper.com/kalitools/theharvester/email-harvester-tool/online/
https://www.nmmapper.com/st/networkmapper/nmap/online-port-scanning/