Issued

Look up a domain

What certificate transparency and DNS enrichment hold for one domain. Returns the certificate record (issuer, SSL expiry, certificate hash, when it was first and last seen) plus every address the domain apex has been observed on, newest first. Accepts a bare hostname or a pasted URL — "https://www.example.com/path" is reduced to the domain. A subdomain is folded to its registrable domain, so "mail.example.co.uk" is answered as "example.co.uk". WHAT THE NULLS MEAN. registered and expires come

Recently logged certificates

Certificates as they were logged, newest first, from a rolling 30-minute window. This is a live tap, not a search: it answers "what is being issued right now", and there is no way to page backwards through it. A name that was logged an hour ago will not appear. To ask about a specific domain use lookup_domain instead. Each entry gives the issuer organisation, the first DNS name on the certificate, and how many names that certificate covers — a high name_count is a shared or wildcard certificat

Corpus size and coverage

How much this corpus holds and how fresh it is: total domains, certificates and log entries seen in the last 24 hours, DNS resolution coverage, CT log health, and the leading issuers and TLDs. Use this to calibrate a claim about coverage before making one — in particular, "domains_no_dns" is the count of domains for which no address has ever been resolved, and it is a large fraction of the corpus. Most of what certificate transparency shows has never resolved. as_of is when the figures were co

Domains on an address

Reverse lookup: which hostnames have been observed resolving to one IP address. NEEDS AN API KEY. Returns the hostname, its registrable domain, and when the pairing was first and last seen. A hosting or CDN address can carry a very long tail of unrelated names — co-location on an address is not evidence of a relationship between the domains, and should not be reported as one. last_seen is when the pairing was last confirmed. An old last_seen means the name has moved or stopped resolving, not t

Domains in an address range

Reverse lookup across a small CIDR range: which hostnames have been observed on any address in it. NEEDS AN API KEY. THE RANGE IS CAPPED AT 256 ADDRESSES — an IPv4 /24 or narrower. That is not a licensing limit. The underlying table is ordered by domain, not by address, so a range is answered by expanding it into an explicit address list that a bloom filter index can serve; a wider range stops being index-assisted and becomes a full scan of 1.48 billion rows. Ask for /24s, and issue several cal

Newly registered domains

Newly registered domains from the ICANN zone-file feeds, oldest first from a cursor. NEEDS AN API KEY. ASCENDING AND CURSOR-PAGED, which is what makes it safe to resume: pass the next_cursor from the previous call as "after" and you continue exactly where you stopped, with no gap, however long you were away. A newest-first feed would silently drop everything that happened between two calls. Omit "after" to start about 48 hours back. caught_up true means this page reached the end of what is av