Our hostname API and UI allows you to find historical observations for a single hostname or domain. This page is a reference for the available fields that can be used to query the Hostname API. Please see explanations about the field types and visibility below.
There are multiple sources for the hostname dataset:
ct: Certificate Transparency - Hostnames extracted from Certificate Transparency (CT) logs; near real-time visibility when new certificates are issued.pdns: Passive DNS - Hostnames observed in historical DNS resolution data; visibility depends on contributing sensors and resolver coverage.scan: Website Scans - Hostnames detected during website scans; freshness depends upon user scan submissions.zonefile: Zonefiles - Hostnames listed in TLD registry-published zone files; typically updated daily or per registry policy.scan-cert-subject: TLS Certificate Subject - Hostnames found in the subject field of scanned TLS certificates; visibility tied to active scanning schedules.scan-link: Website Links - Hostnames discovered as links within scanned web pages; freshness depends on when the source page is submitted for scanning.
The following fields can only be searched on the Professional, Enterprise, and Ultimate plans.
| Field Name | Type | Field semantics, features, & notes |
|---|---|---|
asn.asn | keyword | Any ASN the hostname has been seen on |
asn.country | keyword | ISO 3166-1 2-letter country code of the ASN |
asn.name | text | Name of the ASN of the hostname |
asn.name.keyword | keyword | Name of the ASN of the hostname (analyzed as keyword) |
cname | domain | Last observed CNAME records |
cname.keyword | keyword | Last observed CNAME records (analyzed as keyword) |
dns_records | keyword | Which DNS records were observed for this hostname (A, AAAA, NS, MX) |
domain | domain | The root domain |
domain_words | keyword | Keywords of the hostname, split by non-letter characters |
first_seen | date | Datetime of when hostname was first seen |
geoip.country | keyword | ISO 3166-1 2-letter country code of the IP |
hostname | domain | The full hostname. Wildcard / Regular Expression supported |
hostname.keyword | keyword | The full hostname (analyzed as keyword). Wildcard / Regular Expression supported |
hostname_dashes | integer | The number of dashes '-' in the hostname |
hostname_digits | integer | The number of digits (0-9) in the hostname |
hostname_length | integer | The length of the hostname |
ip | ip | Last observed IPv4/IPv6 values for A/AAAA records |
last_seen | date | Datetime of when the domain was last seen |
mx | domain | Last observed MX records |
mx.keyword | keyword | Last observed MX records (analyzed as keyword) |
nameserver | domain | Last observed NS records |
nameserver.keyword | keyword | Last observed NS records (analyzed as keyword) |
seen_days | integer | The number of days the hostname has been seen for |
sources | keyword | Sources this hostname was observed from (e.g. pdns, ct, zonefiles, scan) |
sources_length | integer | How many sources this has been observed from |
subdomain_levels | integer | The number of subdomain levels on the domain |
tags | keyword | Classification of hostname (e.g. apexDomain, idn, confusables, wildcard) |
tld | domain | The top level domain of the domain |
labels | keyword | High-level system labels applied by urlscan |