Fuzz virtual hostnames using a wordlist.
Command: Linux copy
wfuzz -u http://$IP -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hh 315
References: