Hmm, that's an interesting thing I haven't given much thought to. I think that it would be somewhat difficult to pull off a correlation attack/leakage as the C

Hmm, that's an interesting thing I haven't given much thought to. I think that it would be somewhat difficult to pull off a correlation attack/leakage as the CTLs tend to dump in batches vs every poll returning new results, but I think once you remove a lot of the noise (cloudflare SNI certs, testing domains, etc) it'd potentially show some interesting patterns. https://github.com/CaliDog/certstream-python/blob/master/examples/stat_windows.py https://github.com/CaliDog/certstream-python/blob/master/exa... This demo would be a decent starting point to that analysis if you'd be interested in toying with it!