[gessha]

This is really cool! It discovered even subdomains that lived for a few days on my site. If it’s not a secret, how do you discover those? Is it by listening to DNS record changes?

[Eikon]

By using... certificate transparency logs.

https://www.merklemap.com/documentation/how-it-works