FFUF

subdomain fuzzing will only work on targets that have public dns records. Manually entering local records on /etc/hosts file to map IP address to FQDN will not work due to the lack of public DNS record.

root@oco:~$ ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.{targetSite.tld}:{port}/