Use the free subdomain scanner to lookup and check all the subdomains of a domain. Check how many sub domains you can find to map your attack surface.