This is certificate transparency doing most of the work, right?

zootboy · on Sept 16, 2023

I would assume so. I tested on one of my private domains that generally isn't linked to anywhere, and it just returned the few domains that I generate Let's Encrypt certs for, plus my nameservers.

Interestingly, I did not receive any DNS queries on my authoritative nameservers during the query, so they don't seem to be doing any active DNS probes.

out-of-ideas · on Sept 16, 2023

it may utilize a few techniques as there are subdomains I am aware of that've never been published other than in the zone config on my registrar that are returned from api query

pbhjpbhj · on Sept 16, 2023

I use Siteground and it has a staging server that AFAIK hasn't been used for at least 6 years ...

Nothing at the host has any details of that, archive.org doesn't have it in their site URLs, it's not in DNS records, not in .well-known, it was a transient test years ago ... really curious, must be historic data from somewhere?

RockRobotRock · on Sept 16, 2023

I use Cloudflare for DNS and the only ones it found had LE certs. It's not doing a simple brute-force on common names, I don't think. Otherwise it probably would have found a lot more. Curious about how it works.