@pratik @smokey not unless the domain servers allows AXFR — otherwise yeah brute force is the only way to guess at it which would be a DNS attack