dnsfax
No user record in our sample, but dnsfax has activity below (stories or comments). Likely we have partial data — the full bulk-load will fill profiles in.
No user record in our sample, but dnsfax has activity below (stories or comments). Likely we have partial data — the full bulk-load will fill profiles in.
Certificate transparency logs.
If you know what to query, sure. You can't just say "give me all subdomains"; it doesn't work that way. The subdomain was discovered via certificate transparency logs.