A very common technique but a lot of researchers rely on passive subdomain enumeration rather than active subdomain enumeration.
There are 2 ways you can perform using active subdomain enumeration
Bruteforcing subdomains using wordlist: In this technique we use a DNS wordlist to bruteforce a particular subdomain.
Permutation Bruteforce: In this technique we create a new resolved subdomain list from already known subdomains/domains by using permutation, mutation, and alteration with a wordlist
Favicons are icons that serve as branding to your website.
Each Favicon has some unique hash values which can be used to gather domains with the same hash function.
Favicon hashes are simple to calculate. FavFreak is one of the best tools which does this work for us.
Once the hash is calculated, you can use the same on internet search engines such as shodan to get the mass websites.
We hope that these recon techniques might help you to add and update your methodology.