Nobody allows zone transfers these days. But there is still the option for doing a dictionary attack on subdomains admin/ssh/console.example.com But yeah scann

Nobody allows zone transfers these days. But there is still the option for doing a dictionary attack on subdomains admin/ssh/console.example.com But yeah scanning IPv6 address space directly without DNS dictionary in hand is tough.