CT Watcher
New domains the moment their first certificate is logged.
- Past hour
- —
- Today
- —
- Extensions
- —
- Certificate logs
- —
Counting…
Counting…
With new names in 24 hours
Checking…
New domains
Names not in the zone index when their first certificate was logged.
| Domain | Status | DNS host | Seen |
|---|
Registered uses the registry's creation date. New since last zone file means a generic name absent from yesterday's complete zone file. Not in zone index marks a country-code name we cannot date yet. DNS host is the provider the name's nameservers point to: usually the registrar's default DNS, sometimes a host like Cloudflare.
Busiest extensions
24 hLoading…
New domains per hour
48 h · UTCLoading…
DNS hosts and registrars
Country-code domains found in certificate logs. For today and the last 7 days, DNS hosts come from a nameserver lookup of every domain, run each minute, with RDAP as a fallback. All-time uses RDAP only. Registrars come from RDAP, which most country-code registries do not publish. Select a row to list its domains.
DNS hosts
Computing…
Registrars
Computing…
Coverage
Collector status
Logs are split by the date a certificate expires, so new certificates land in next year's shards. CT Watcher reads every shard that is still open, in both log formats, from the Chrome and Apple log lists.
Loading…
About CT Watcher
How do I find new domains in Certificate Transparency logs?
CT Watcher reads every open Certificate Transparency log and lists new domains within seconds of their first certificate. It keeps names that are not in Toyroom’s zone index yet, across generic and country-code extensions, and labels how each one is known to be new. A certificate is not proof of a registration, so registry creation dates are shown where registries publish them.
How to use it
- Watch the live feed. It adds new domains every few seconds; pause it to read.
- Filter by extension type, by extension, or by part of a name. Export the last 24 hours to CSV.
- Open a DNS host or registrar to list its names, and export them to CSV.
Data and limits
- Source
- Every open shard of every log on the Chrome and Apple lists, in both log formats, read directly.
- Speed
- Most names appear within 10 seconds of the log entry. Coverage shows each log’s status.
- Coverage
- Generic and country-code extensions. Names under registries that answer for unregistered names count only with real nameservers.
- Exports
- Up to 50,000 new domains from the last 24 hours, and up to 5,000 rows per DNS host or registrar.
- Cost
- Free. No account and no verification step.
Questions
What is Certificate Transparency?
Certificate Transparency (CT) is a set of public, append-only logs of the SSL/TLS certificates that browsers trust. Certificate authorities log every certificate they issue, so a new website usually appears in CT logs soon after it gets HTTPS.
Why read every log shard?
Logs are split by the date a certificate expires. A certificate issued today lands in next year’s shard, so a reader that follows only the current shard misses most new certificates. CT Watcher reads every shard that is still open.
Is a domain in CT logs newly registered?
Not always. Older domains get new certificates too. Generic extensions publish complete zone files daily, so a generic name missing from the latest file is new. For country codes without zone files, CT Watcher shows the registry creation date where it can, and marks the rest as not in the zone index.
Does it list every new domain?
No. A domain appears only once it gets a certificate, and many new domains never do. Zone files cover the rest: see Registration Analytics for daily registrations.