Third Party
Waybackmachine & others
Use gau to search for old files and paths from crawl websites
echo "example.com" | gau --subs
Alienvault
Look under Associated Urls
https://otx.alienvault.com/indicator/domain/example.com
AWS Scraping
By visiting IP’s under AWS control and looking for certificates it is possible to find content owned by a company.
https://github.com/jhaddix/awsScrape/