Live subdomains on valid certificates

What this example returns

The dataset’s “Subdomains” view shows 14 columns: Domain, Subdomain, Wildcard, Resolves, IP, CC, Network, Provider, Certificates, First seen, Last seen, Cert expires, Valid cert, and Issuers. See every output field.

What each setting does

The input this example runs IP, ASN & Subdomain Lookup with. “Try this input” opens it in the console, where you can run it as-is or change any field first.

Domains (list subdomains) domains

python.org, not a domain

Domains to list subdomains for, e.g. python.org. Every name that appeared on a public TLS certificate (certificate-transparency logs) is returned, with first and last seen dates, issuers and, by default, its IP address, country and network.

Include names from expired certificates includeExpired

No

Also list names that only appear on expired certificates (the full history). Off: only names on certificates that are still valid.

Default: Yes → this example uses No

Only subdomains that resolve onlyResolving

Yes

Keep only subdomains that currently have an IP address (needs Resolve subdomains). Wildcard names are left out too.

Default: No → this example uses Yes

{
  "domains": [
    "python.org",
    "not a domain"
  ],
  "includeExpired": false,
  "onlyResolving": true
}

What it costs

You pay for the events the actor reports, such as each result or page it produces. Platform usage is included in the event prices: compute, proxies, browser and storage cost nothing extra.

• IP lookupfrom $0.00225One IP address row: location, time zone, ASN and ISP, BGP prefix, reverse DNS, hosting and Tor flags, risk score and (when on) the registry record. Invalid entries and rows removed by your filters are free.
• Subdomain$0.00065One subdomain row from certificate-transparency logs, with certificate dates and issuers and (when on) its IP address, country and network.

Full pricing

Other ways to run IP, ASN & Subdomain Lookup

• Enrich IPs with location, network and abuse contactsIPv4/IPv6 addresses and a hostname with country, city, ASN, ISP, BGP prefix, reverse DNS, hosting, Tor, registry record and a US-only risk check.
• Find subdomains from certificate logsEvery subdomain two domains put on public certificates, with dates, issuers and the IP, country and network each name resolves to.

All examples of IP, ASN & Subdomain Lookup

About IP, ASN & Subdomain Lookup

Bulk IP lookup: country, city, time zone, ASN and ISP, BGP prefix, reverse DNS, cloud/hosting and Tor flags, registry abuse contacts and a risk score for every IPv4/IPv6 address or hostname. Plus every subdomain of a domain from certificate-transparency logs, resolved to its IP, country and network. No login or API key needed.

Price:

from $2.25 / 1,000 results

Developer:

Querystone

Categories:

Developer tools, Automation

IP, ASN & Subdomain Lookup pageOutput fieldsPricing