Our hostname API and UI allows you to find historical observations for a single hostname or domain. This page is a reference for the available fields that can be used to query the Hostname API. Please see explanations about the field types and visibility below.
There are multiple sources for the hostname dataset:
ct: Certificate Transparency - Hostnames extracted from Certificate Transparency (CT) logs; near real-time visibility when new certificates are issued.pdns: Passive DNS - Hostnames observed in historical DNS resolution data; visibility depends on contributing sensors and resolver coverage.scan: Website Scans - Hostnames detected during website scans; freshness depends upon user scan submissions.zonefile: Zonefiles - Hostnames listed in TLD registry-published zone files; typically updated daily or per registry policy.scan-cert-subject: TLS Certificate Subject - Hostnames found in the subject field of scanned TLS certificates; visibility tied to active scanning schedules.scan-link: Website Links - Hostnames discovered as links within scanned web pages; freshness depends on when the source page is submitted for scanning.
The following fields can only be searched on the Professional, Enterprise, and Ultimate plans.
| Field Name | Type | Field semantics, features, & notes |
|---|---|---|
asn.asn | keyword | Any ASN the hostname has been seen on |
asn.country | keyword | ISO 3166-1 2-letter country code of the ASN |
asn.name | keyword | Name of the ASN of the hostname |
dns_records | text | The type of DNS record (e.g., NS or MX) |
domain_words | keyword | Keywords extracted from the hostname |
domain | keyword | The root domain |
first_seen | date | Datetime of when domain was first seen |
geoip.country | keyword | ISO 3166-1 2-letter country code of the IP |
hostname_dashes | integer | The number of dashes ‘-’ in the hostname |
hostname_digits | integer | The number of digits (0-9) in the hostname |
hostname_length | integer | The length of the hostname |
hostname | keyword | The full hostname |
ip | ip | Any IP the hostname has been seen on |
last_seen | date | Datetime of when the domain was last seen |
nameserver | keyword | The nameserver of the hostname |
seen_days | integer | The number of days the hostname has been seen for |
sources | text | Hostnames seen in specific sources (e.g., ct) |
subdomain_levels | integer | The number of subdomain levels on the domain |
tags | text | System defined tags related to the hostname (e.g., wildcard) |
tld | keyword | The top level domain of the domain |