Recursively scan for subdomains