The OP says it's using CT logs, not new domain registrations. The approach you have in mind would not include subdomains and would be less likely to coincide with a new server being configured.
Yes CT is explicitly stated source which is why I qualified it with "Guess" for domain registration. There were couple reasons for that -
1. Quite a few websites in the search results where just on HTTP
2. The .gov sites do use public certificate authorities like digicert, verisign, amazon & letencrypt so they would have been captured unless they are removed explicitly
And yes the domain registration would not include subdomains
1. Quite a few websites in the search results where just on HTTP
2. The .gov sites do use public certificate authorities like digicert, verisign, amazon & letencrypt so they would have been captured unless they are removed explicitly
And yes the domain registration would not include subdomains