[Kab1r]

Is this just searching certificate transparency logs?

[yup_sto]

I'd imagine it's a combination of

- CT log monitoring (https://github.com/CaliDog/CertStream-Server)

- Mass-Scanning across ipv4 on 80/443 at the least?

- Brute-forcing subdomains on wildcards with large DNS wordlist (like something from assetnote: https://wordlists-cdn.assetnote.io/data/manual/best-dns-word...)

- Scraping/extracting subdomains/domains from JS

But I've never attempted to enumerate subdomains on this scale before, so I could be missing something obvious

[flemhans]

I think it's a mix of different sources. Certainly, some of my subdomains there never had an SSL certificate.

[Eikon]

Well, CT logs are a data dump, they are not searchable, ingesting all that data near-real time and making it searchable in a useful and fast way (especially with wildcards) is actually quite challenging!

[stavros]

Where does one ingest them from?

[remram]

I have subdomains with (non-wildcard) certificates that aren't on there.