Hacker News Reader

I use subdomains and a wildcard cert to partly obfuscate this.

I do the same, but I switched from cert-per-subdomain a couple of years ago.

They're either using Passive DNS logs or a historical dataset.