What are your sources for hostnames to crawl? I looked into it a long time ago and seem to remember there was a way to get access to registration records, but

What are your sources for hostnames to crawl? I looked into it a long time ago and seem to remember there was a way to get access to registration records, but I imagine combining that with HTTP certificate transparency records would significantly increase your hostname list. Anything else?