Comment by andix

Much better. But you still leave traces from dns queries.

Subfinder has a lot of sources to find subdomains, not only certs: https://github.com/projectdiscovery/subfinder