Domains, Certificate Transparency and DNS, the moment it's issued.
For threat hunters, incident responders and anyone tracking infrastructure: what a domain's certificate says, who issued it, when it expires, and where it points.
Certificate, issuer, expiry, hosting address and DNS for any domain we have seen in a Certificate Transparency log.
From the logs: what we have observed
The free API
The same record as a JSON document. No key, no sign-up.
Live response
one URL, JSON to a script and a page to a browser$ curl issued.live/tuxxin.com { "domain": "tuxxin.com", "registered": "2011-04-27T06:24:46Z", "expires": "2027-04-27T06:24:46Z", "ssl_expires": "2027-01-10T09:18:29Z", "ssl_cert": "2283D23B5BEA953A6E19D21CAD3D93F6", "ssl_issuer": "Google Trust Services", "ip": "188.114.96.0", "last_update": "2026-10-16T14:12:24Z", "first_cert_seen": "2026-09-18T16:27:06Z", "tracked": false, "first_zone_seen": null }
From the CT logs
connectingA real response from the running API, refreshed with the page:
every key it returns, in the order it returns them. ip comes from our own resolvers.
We populate registered and expires only where we hold
registration data; until then they are null, and we never guess them.
The list beside it is certificates as we log them; pick a name to load its record here.
A thousand lookups a day need no key. Beyond that, or for the reverse-IP endpoints, a key comes with a plan.
Agents can call it directly: issued.live
speaks the Model Context Protocol at
/mcp, and every page has a .md twin.
How the data gets here
We read the public CT logs continuously, and ingest the ICANN zone file feeds for newly registered domains. Two streams come in: certificates as they are logged, and domains as they are registered. We join and enrich them and keep the history, so each domain ends up with one record and a trail of what changed to get there.
