Acerca de

How the index is built The index reads every usable CT log in Chrome's and Apple's programs as entries land: Static CT (Let's Encrypt Sunlight, Geomys, Cloudflare Raio) and legacy RFC 6962 (Google Argon, Sectigo, DigiCert). It parses each certificate in memory, pulls out the SAN hostnames, then throws the rest away. That only covers new entries. Older names come from retired CT logs replayed from the Internet Archive, plus Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, and HaGeZi DNS blocklists. A prober also works through common hostnames against known apexes on a loop, and anything it turns up joins the same index. The index normalizes every name by apex and keeps three fields: (apex, subdomain, first-seen). It holds no certificate metadata and never deletes a name.