If anyone is interested in mitigation, the only way around this AFAIK is to start with a brand new domain, only use wildcard certs (with DNS validation), and don’t bundle multiple renewals into a single cert.

Also, don’t enter your domain or related IP address into dns reverse engineering tools (like dnsdumpster), and check certificate transparency logs (crt.sh) to see what information related to your cert renewals has been published.

This won’t stop automated bots from scanning your ip for domains, but should significantly reduce the amount of bots that discover them