Much better. But you still leave traces from dns queries. Subfinder has a lot of sources to find subdomains, not only certs: https://github.com/projectdiscover

Much better. But you still leave traces from dns queries. Subfinder has a lot of sources to find subdomains, not only certs: https://github.com/projectdiscovery/subfinder https://github.com/projectdiscovery/subfinder