I do the same, but I switched from cert-per-subdomain a couple of years ago.

They're either using Passive DNS logs or a historical dataset.