Note that Bulk DNS Records are a very affordable service. I don't know if Shodan throws those in, it may not, but if your attacker isn't a bored teenager who to

Note that Bulk DNS Records are a very affordable service. I don't know if Shodan throws those in, it may not, but if your attacker isn't a bored teenager who took a momentary interest they absolutely do have those records. If you can afford Netflix you can afford to subscribe to that data from a reputable supplier. The way they're obtained is, if you operate a huge public DNS service, you collect the set of answers you saw, with timestamps but no PII, and you just sell that. If you take this data from a handful of the biggest DNS services you've got maybe 95% coverage of everything out there. Sure 99% of users of hr.big-bank.example will be Big Bank employeees at work with local DNS, but 1% is people who are at home, or off-site or whatever and maybe it doesn't even work without VPN, but someone will click it by accident and so it gets collected.