Every certificate issued for every domain on the public internet gets written to a public log. Anyone can read them. Almost nobody does — because the raw feed is a firehose of tens of thousands of entries a second, and a certificate on its own doesn’t tell you much.
That’s the gap issued.live fills. It reads the Certificate Transparency logs continuously, joins them to ICANN zone-file registration data and to its own DNS scans, and keeps the result as one record per domain with a trail of what changed to get there.
It’s live now, and domain lookups are free with no key and no sign-up.
One record for one domain — certificate, hosting, network, and when each of those was last confirmed.
One URL, three ways to read it
The thing we care most about here is that the same record is available in whatever shape the thing asking for it actually wants. There are three, and they are the same data underneath.
1. JSON, for a script
Point curl at any domain:
curl issued.live/tuxxin.com
{
"domain": "tuxxin.com",
"registered": null,
"expires": null,
"ssl_expires": "2026-11-28T10:58:19Z",
"ssl_cert": "431095AFAB96BC5C282ED931FC907068",
"ssl_issuer": "Google Trust Services",
"ip": "104.21.65.210",
"last_update": "2026-08-30T11:16:06Z",
"first_cert_seen": "2026-08-14T07:47:20Z",
"tracked": false
}
That ssl_cert value is a stable identifier for the exact certificate, which is more useful than it looks: it lets you tell a genuine reissue from a routine renewal without diffing the whole chain. And last_update is there so you can judge freshness yourself rather than trusting that the record is current.
2. Markdown, for a human or a language model
Append .md to any lookup and you get the same record as a document — certificate, registration, hosting, address history and DNS records, as tables:
curl issued.live/tuxxin.com.md
This exists because a model quoting from a page wrapped in navigation and CSS gets it wrong more often, and burns a pile of tokens doing it. The markdown form is the same data at a fraction of the size. There’s a /llms.txt at the root that maps what’s worth fetching.
3. MCP, for an agent
issued.live speaks the Model Context Protocol directly, so an assistant can query it as a tool rather than scraping pages. Six tools are exposed:
-
lookup_domain— the full certificate and DNS record for one domain. -
recent_certificates— a rolling 30-minute window of certificates as they are logged. -
corpus_stats— how much the corpus holds and how fresh it is. -
domains_on_ip— reverse lookup: which hostnames have been seen on an address. (key required) -
domains_in_range— the same across a small CIDR range. (key required) -
new_domains— newly registered domains from the ICANN zone-file feeds. (key required)
And there is, of course, the website — server-rendered, nothing behind a login, no client-side rendering step.
Three streams, joined
What makes a record worth reading is that it isn’t one source.
Certificate Transparency logs give you certificates as they are issued. ICANN zone-file feeds give you domains as they are registered. DNS scanning gives you where a name actually points — every domain in the corpus is re-scanned for freshness on roughly a 48-hour cycle, merged across four vantage points, so what you get is a confirmed observation rather than a live lookup you have to wait on.
Joined, those answer questions none of them answer alone: what a domain looks like right now, what addresses it has rotated through, and what has just appeared that didn’t exist yesterday.
What a null means
This is the part we’d point at if you only read one section.
Registration dates come from zone-file feeds, and they are genuinely absent for a lot of names. So registered: null means “we do not hold this” — it never means “this domain is not registered.” The record will not guess, and it will not quietly infer a registration date from a certificate date, because those are not the same thing and treating them as such produces confident nonsense.
Same discipline on first_cert_seen: it’s the first time any CT log carried a certificate for that name. An old domain that only recently got its first certificate will show a recent date there. That’s not a bug, it’s what the field means.
Every page says the same thing in plain language: this is an observation drawn from public logs — what was seen, and when.
Feeds and reverse lookups
Two feeds need no key at all. /api/feed is a rolling 30-minute window of certificates, newest first. /api/stats is corpus-wide counts — domains known, certificates in the last 24 hours, ingest rate, per-TLD breakdown and log health — served from a snapshot regenerated every ten minutes, so it’s cheap to poll.
The reverse questions need a key, and it’s free: /api/v1/ip/{ip} and /api/v1/range/{cidr} answer which domains resolve to an address or a small range, and /api/v1/nrd is the newly-registered-domain feed. That’s the half that matters for brand protection — a look-alike domain and its fresh certificate usually go live minutes before the first victim ever clicks.
Scale
At the time of writing the corpus holds 334,121,692 domains, saw 15,892,349 certificates in the preceding 24 hours, and is reading 56 of 58 known CT logs. Ingest runs in the tens of thousands of entries per second.
A thousand lookups a day need no key whatsoever. Beyond that, or for the reverse-IP endpoints, a key is free — just ask.
Try it
Pick any domain you own and run:
curl issued.live/yourdomain.com
If the certificate expiry surprises you, that’s the point.
issued.live — full API documentation at issued.live/developers. It joins qsa.sh, whack.sh and worldip.io in the Tuxxin Stack.
