TheHarvester

theHarvester -d countrygarden.com.cn -l 100 -s -b all

-d #DOMAIN
-l LIMIT            #Limit the number of search results, defaul­t=500
-S START             #Start with result number X, default=0.
-g                   #Use Google Dorks for Google search.
-p                    #Use proxies for requests, enter proxies in proxie­s.yaml.
-s                   #Use Shodan to query discovered hosts.
--scre­enshot        #Take screen­shots of resolved domains
-v                 #Verify host name via DNS resolution and search for virtual hosts.
-e                 #DNS server to use for lookup.
-t DNS_TLD         #Perform a DNS TLD expansion discovery, default False.
-r                  #Check for takeovers.
-n                  #Enable DNS server lookup, default False.
-c                 #Perform a DNS brute force on the domain.
-f                 #FILENAME  Save the results to an XML and JSON file.
-b SOURCE           anubis, baidu, bing, binary­edge, bingapi, buffer­overun, 
                    censys, certsp­otter, crtsh, dnsdum­pster, duckdu­ckgo, github­-code,
                    google, hacker­target, hunter, intelx, linkedin, linked­in_­links, 
                    netcraft, omnisint, otx, pentes­ttools, projec­tdi­sco­very, qwant, 
                    rapiddns, rocket­reach, securi­tyT­rails, spyse, sublist3r, 
                    threat­crowd, threat­miner, trello, twitter, urlscan, virust­otal, 
                    yahoo, zoomeye, all