Scan for subdomains