During the passive reconnaissance phase of an external engagement, a penetration tester wants to build a comprehensive list of the target organization's subdomains without sending any packets directly to the target's infrastructure. The tester needs a tool that aggregates data from third-party sources such as certificate transparency logs, search engine results, and DNS aggregation databases. Which command best supports this goal?