What I did
As part of auditing my own domain’s security posture, I ran a passive Certificate Transparency query against yulan.me, pulling every certificate ever logged for the domain — a fully public and non-intrusive data source.
What came back
The query returned over 600 historical certificate records. The overwhelming majority had nothing to do with my own infrastructure: certificates issued, in bursts over many months, for subdomains carrying clear spam and pirated-content naming patterns — the kind of footprint left by an ad-arbitrage or SEO-spam operation exploiting a previous registration of the domain. Certificate Transparency logs are permanent and publicly auditable by design, so that record persists regardless of who owned the domain at the time.
Verification
Collection is trivial. The work was separating the one actionable line from the noise, and confirming the noise really was just noise.
I verified the finding with passive DNS lookups: none of the flagged subdomains currently resolve, and the zone carries no live wildcard record today. Cross-referencing issuance dates against my own ownership window showed a clean boundary — nothing matching the historical spam pattern has been issued since I acquired the domain, only routine automatic renewals from my own hosting setup.