All the obvious things have been mentioned.

The only way to identify the problem is to share the exact steps youve followed and then others can reproduce.

Based on what youve told us, no one knows how the subdomain is leaked. Without meaning to be derisive, that suggests that something youve told us isn’t quite correct.