keisatsu

Yeah it took a while for me to find as well, Debian moved to managing alot of packages you used to install with pip. In many cases you can just prefix pip packages with python3- and find them via apt.

apt install python3-certbot :)

Probably not. It’s most likely automated scanning and the subdomains seem common enough to be included in wordlists. Another possibility is that the subdomains have leaked somehow, do you use LetsEncrypt? If so, the existence of your subdomains is public knowledge and can easily be picked up by bots.