There's been an update, right at the end of DNSDumpster subsection

"Certificate Transparency (CT) Logs

The most effective passive subdomain discovery method today is Certificate Transparency logs, accessible through crt[dot]sh.

Certificate Transparency is a public logging framework (mandatory since approximately 2015) that records every SSL/TLS certificate issued by participating Certificate Authorities. Each certificate contains a Subject Alternative Name (SAN) field listing the domains and subdomains it covers. By searching these logs, you can discover subdomains without sending any traffic to the target.

To use crt[dot]sh, visit their site and search for %.[t]ryhackme[.]com. The % wildcard matches any subdomain. The results will list every certificate issued for subdomains of tryhackme[dot]com, often revealing 10 to 100 times more subdomains than DNSDumpster alone.

crt[dot]sh is fully passive, operates in real time, and has no rate limits for basic use.

Other passive subdomain discovery options include SecurityTrails (free limited searches) and command-line tools like Subfinder, which aggregate multiple passive sources.

Defender perspective: Organisations monitor CT logs and subdomain lists to catch dangling DNS records (which carry subdomain takeover risk) or unauthorised subdomains."