Hostnames

The Hostnames data source tracks newly observed Domains and Hostnames from a variety of external and internal data sources in real time. It incorporates observations from these heterogeneous sources to build a single authoritative database of hostnames and domains along with the information about when and where they have been observed and what their latest observed attributes look like.

Hostnames are only available in urlscan Pro.

When to use

You should use this dataset to look at specific known domains or to hunt for new unknown domains and hostnames.

Constituting data sources

We use the following data sources to compile the Hostnames data source:

• ct – Certificate Transparency logs – We real-time ingest all current and historical TLS certificates from various CT logs, also see Help
• zonefile – DNS Zonefiles for generic TLDs, ingested daily at around 2am UTC
• pdns – Captured DNS responses from our own active resolution attempts, ingested real-time
• scan – Website scans performed on urlscan.io, ingested real-time
• scan-link – Outgoing link from a historical website scan, ingested real-time
• scan-cert-subject – TLS certificate observed in a historical website scan, ingested real-time

Concepts / FAQ / Gotchas

• The First Seen timestamp gives an indication of the first time we have observed the item. It does not mean that the domain was registered on this date, or that it did not resolve before that.
• Once an item enters our dataset we will typically try to resolve it (e.g., A/AAAA/NS/MX/CNAME/SOA). We will also frequently re-resolve older items.
• We also capture DNS wildcard hostnames (e.g., *.foobar.com).

Historical Observations

We store the historical observations for each hostname and domain. You can access these historical observations by clicking on the timestamp in the list of Hostname results.