Downloads

Every dataset as a daily file, in csv.zst and json.zst. Sign in to download; the file reference describes every column, and the feeds page covers fetching with an API key.

A Basic plan covers the domains and DNS files; Pro adds DNS by vantage point, certificates and address history. See the plans.

A file marked delta holds the records that changed since the previous file, applied as upserts; a snapshot is the whole corpus for that dataset, for seeding a new system. Seed from the latest snapshot, then apply the deltas dated after its as_of. One download per file per day, shared between this page and the API key, resetting at 00:00 UTC. Files stay on this page for 14 days; every file we publish is archived permanently. A Pro file needs a Pro plan; the plans are here.

What you get

The first line of every CSV names the columns, and the JSON file carries the same fields per line. Full meanings are on the file reference.

"domain","tld","registered","expires","registrar","ip","first_cert_seen","first_zone_seen","last_update"
"example-shop.com","com","2019-04-02T11:15:00Z","2027-04-02T11:15:00Z","GoDaddy.com, LLC","203.0.113.42","2026-09-06T06:22:11Z","","2026-09-16T04:11:50Z"

"name","record_type","values","ttl","last_confirmed"
"aaa.aaa","NS","[""ns-1058.awsdns-04.org"",""ns-1680.awsdns-18.co.uk"",""ns-199.awsdns-24.com"",""ns-978.awsdns-58.net""]",172800,"2026-09-16T20:39:54Z"

"name","record_type","vantage","values","ttl","last_seen","last_changed","changes"
"example-shop.com","TXT","fra","[""v=spf1 ip4:203.0.113.0\/24 -all""]",300,"2026-09-16T05:02:11Z","2026-08-30T17:40:02Z",1

"cert_id","cert_sha256","serial","spki_sha256","issuer","issuer_org","subject_cn","key_alg","key_bits","signature_alg","sans","san_count","wildcard","ja4x","first_observed","last_observed","ct_logs_seen"
"9f53ecddf913afba5678c924a95149d2","3b1f...c2","0a1b2c","e3b0c442...","CN=YE2,O=Let's Encrypt,C=US","Let's Encrypt","example-shop.com","ECDSA",256,"SHA256-ECDSA","[""example-shop.com"",""www.example-shop.com""]",2,false,"2bab15409345_2bab15409345_a475d2a3f9e8","2026-09-14T22:03:19Z","2026-09-16T11:40:55Z",3

"domain","ip","first_seen","last_seen","observed","current"
"example-shop.com","203.0.113.42","2026-08-21T09:14:03Z","2026-09-16T22:41:50Z",37,true

Opening a .zst file

Zstandard, not gzip: smaller and much faster to decompress. Most data tools read it directly, so you rarely need to unpack it first.

# unpack, or stream the first rows without unpacking
zstd -d delta.domains.csv.zst
zstd -dc delta.domains.csv.zst | head -3

# read it where it lies
duckdb -c "SELECT * FROM read_csv('delta.domains.csv.zst') LIMIT 5"
python -c "import pandas; print(pandas.read_csv('delta.domains.csv.zst', nrows=5))"

Install with apt install zstd, brew install zstd or, on Windows, 7-Zip.

Basic+ means Basic, Plus and Pro all include that file. Pro means Pro only. Plus buys query capability rather than bulk, so it takes the same two files as Basic — see the plan comparison.

Verifying what you downloaded

Every day publishes a checksums.txt in sha256sum format, listing every file for that day. It needs no key, so you can check a file you already hold:

curl -sO https://issued.live/downloads/2026-09-18/checksums.txt
sha256sum -c checksums.txt

Do this. A truncated .zst still opens in some tools and DuckDB reads one without reporting an error, so a short file becomes missing rows rather than a failure. zstd -t catches a damaged or truncated file on its own — the digest is what tells you it is the right file, the one we published for that day, which is what you need if you ever have to show where a finding came from.

A file will look smaller on disk than it does here. Sizes on this page are decimal GB, the unit disks and bandwidth are sold in; ls -lh and du -h report GiB, which is about 7 per cent fewer of a bigger unit. A file listed here as 3.9 GB shows as 3.6G under ls. Both are the same file, and the checksum above settles it either way.

Subscribers get the same digest two other ways: the sha256 field on every entry of the file listing, and an X-Checksum-Sha256 header on the download itself. Do not verify against the object store's ETag — for a large multipart upload it is not the MD5 of the file, and it will not match.

Files are generated once a day from midnight US Eastern; the latest set finished 2026-09-19 11:42:56 UTC.