[lyu07282]

is this making use of letsencrypt as well? afaik all letsencrypt signed certificates including all subdomains are immediately public, which could be useful for security research as well

[Eikon]

It's not about letsencrypt but certificate transparency which works the same for all public CAs.

I wrote a documentation piece here:

https://www.merklemap.com/documentation/how-it-works

[whalesalad]

At first glance it looks like this data is generated via the public certificate transparency log, so I would imagine the answer is yes.