If your browser is based on chromium, you’re employing an army of bots yourself that gets enabled each time you enter any domain.

Can you explain what you mean exactly?

Yeah I worked for company with publicly exposed server, the logs were amazing.

Just bots scanning default ports trying default username and password for services like Microsoft SQL server.

That’s been happening since forever, though. I helped manage proxy servers for my first job in the mid 00’s, and those server logs were mostly automated port scans and failed login attempts, even on the newly commissioned servers.

Registering SSL is a centralized process with root CAs logging new ones as they come in. Cert transparency logs are a thing, and Google is very involved: certificate.transparency.dev

Once a bad actor hooks up to that, they just get a realtime stream of places to start port scanning and running WHOIS queries for people who didn’t get WHOIS protection. If you used letsencrypt your domains you registered certs for got sent there and anyone who wanted to know about it knew about it before you could tell anyone.

You can use something like crt.sh to look up domains