wfuzz -u http://$IP -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hh 315

Fuzz virtual hostnames using a wordlist.

Command: Linux

References:

https://github.com/xmendez/wfuzz