Domain search
Lists domains rather than scans, including domains ScanMalware has never scanned. Each row shows the newest public scan of that domain, if there is one. To search scans instead, use advanced search.
Examples
- ct_ip:158.94.209.214 — Domains seen on one IP
- ct_ip:158.94.209.0/24 — Domains seen across a /24
- nameserver:harbor.spicas.top — Domains on a nameserver
- nameserver:ns.binero.se AND tld:se — Domains on a nameserver, one TLD
- ct_domain:*ledger-live* — Certificate names containing a word
- ct_domain:*.pages.dev AND ct_issued:last7d — New certificates under a platform
Filters
- ct_ip:
- IP address, or an IPv4 /24 (IPv6 /48) or narrower. Domains seen on it when their certificates were issued, last 90 days.
- nameserver:
- Exact nameserver name. Registered domains delegated to it.
- tld:
- Only with nameserver: one TLD, e.g. nameserver:ns1.example.com AND tld:se.
- ct_domain:
- Hostname in certificate logs, exact or with * wildcards (wildcards search the last 30 days).
- ct_san:
- Certificate SAN entry, exact or wildcard.
- ct_issued:
- Only with ct_domain or ct_san, e.g. ct_issued:last7d.
One ct_ip or nameserver filter per query (nameserver can add tld); ct_domain, ct_san and ct_issued can be combined with AND.