Downloads

Every dataset as a daily file: csv.zst for domains, DNS and address history, and parquet for certificates. Sign in to download; the file reference describes every column, and the feeds page covers fetching with an API key.

A Basic plan covers the domains and DNS files; Pro adds DNS by vantage point, certificates and address history. See the plans.

A file marked delta holds the records that changed since the previous file, applied as upserts; a snapshot is the whole corpus for that dataset, for seeding a new system. Seed from the latest snapshot, then apply the deltas dated after its as_of. One download per file per day, shared between this page and the API key, resetting at 00:00 UTC. Files stay on this page for 14 days; every file we publish is archived permanently. Every dataset is included from Plus upward; the plans are here.

What you get

The first line of every CSV names the columns, and the JSON file carries the same fields per line. Full meanings are on the file reference.

"domain","tld","registered","expires","registrar","ip","first_cert_seen","first_zone_seen","last_update"
"example-shop.com","com","2019-04-02T11:15:00Z","2027-04-02T11:15:00Z","GoDaddy.com, LLC","203.0.113.42","2026-09-06T06:22:11Z","","2026-09-16T04:11:50Z"

"name","record_type","values","ttl","last_confirmed"
"aaa.aaa","NS","[""ns-1058.awsdns-04.org"",""ns-1680.awsdns-18.co.uk"",""ns-199.awsdns-24.com"",""ns-978.awsdns-58.net""]",172800,"2026-09-16T20:39:54Z"

"name","record_type","vantage","values","ttl","last_seen","last_changed","changes"
"example-shop.com","TXT","fra","[""v=spf1 ip4:203.0.113.0\/24 -all""]",300,"2026-09-16T05:02:11Z","2026-08-30T17:40:02Z",1

cert_id             FixedString(16)      issuer_dn      String
tbs_sha256          FixedString(32)      issuer_o       String
final_der_sha256    FixedString(32)      key_alg        String
precert_der_sha256  FixedString(32)      key_bits       UInt16
serial              String               sig_alg        String
issuer_spki_sha256  FixedString(32)      cert_id_mode   String
spki_sha256         FixedString(32)      ja4x           String
not_before          DateTime64(3,'UTC')  dns_names      Array(String)
not_after           DateTime64(3,'UTC')  subject_cn     String
first_seen          DateTime64(3,'UTC')  san_count      UInt16
last_seen           DateTime64(3,'UTC')  log_keys       Array(UInt16)
ingested_at         DateTime64(3,'UTC')  saw_final      UInt8
entry_ptr           Tuple(UInt8, UInt16, UInt64)

"domain","ip","first_seen","last_seen","observed","current"
"example-shop.com","203.0.113.42","2026-08-21T09:14:03Z","2026-09-16T22:41:50Z",37,true

Opening a .zst file

Zstandard, not gzip: smaller and much faster to decompress. Most data tools read it directly, so you rarely need to unpack it first.

# unpack, or stream the first rows without unpacking
zstd -d delta.domains.csv.zst
zstd -dc delta.domains.csv.zst | head -3

# read it where it lies
duckdb -c "SELECT * FROM read_csv('delta.domains.csv.zst') LIMIT 5"
python -c "import pandas; print(pandas.read_csv('delta.domains.csv.zst', nrows=5))"

Install with apt install zstd, brew install zstd or, on Windows, 7-Zip.

Basic+ means Basic, Plus and Pro all include that file. Plus+ means Plus and Pro. Every dataset is available in bulk from Plus upward; Pro adds the live query surface. See the plan comparison.

Verifying what you downloaded

Sample next to a file downloads its header and five real rows from that day's actual file: free, no account, nothing to decompress. It is there so you can check the columns, the types and the data quality against your own pipeline before you buy. Samples are regenerated every night alongside the files themselves.

Every day publishes a checksums.txt in sha256sum format, listing every file for that day. It needs no key, so you can check a file you already hold:

curl -sO https://issued.live/downloads/2026-11-02/checksums.txt
sha256sum -c checksums.txt

Do this. A truncated .zst still opens in some tools and DuckDB reads one without reporting an error, so a short file becomes missing rows rather than a failure. zstd -t catches a damaged or truncated file on its own. The digest is what tells you it is the right file, the one we published for that day, which is what you need if you ever have to show where a finding came from.

A file will look smaller on disk than it does here. Sizes on this page are decimal GB, the unit disks and bandwidth are sold in; ls -lh and du -h report GiB, which is about 7 per cent fewer of a bigger unit. A file listed here as 3.9 GB shows as 3.6G under ls. Both are the same file, and the checksum above settles it either way.

Subscribers get the same digest two other ways: the sha256 field on every entry of the file listing, and an X-Checksum-Sha256 header on the download itself. Do not verify against the object store's ETag. For a large multipart upload it differs from the MD5 of the file, and it will not match.

Files are generated once a day from midnight US Eastern; the latest set finished 2026-11-03 15:51:23 UTC.