I often needed to find sub-domains of a domain. Simple Google search for any tool doesn’t return any good results. There are couple of command line tools which does some brute forcing. But they are painfully slow.
I found another easier way to do this using Wolfram Alpha.
- Visit http://www.wolframalpha.com
- Search for the domain you want sub-domains of. For example, htc.com
- Click on “Subdomains” tab in web statistics section.

Wolfram Alpha will list of known sub-domains of the domain

Of course, it might not list all the sub-domains, but this should be a good enough starting point without going to the command line.