Certificate Transparency Log

Real-time monitoring of publicly-issued TLS certificates

Search syntax & examples(click to expand)

Basic text search

Any substring across domains, issuer, and CN:letsencryptstagingapi.mycompany.com

Minimum 3 characters per term (trigram index).

Column filters

Search only in domain names:domain:paypal.comdomain:login

Search only in issuer organisation:issuer:Let's Encryptissuer:DigiCert

Search only in subject CN:cn:*.internal.corpcn:localhost

AND — multiple terms (implicit)

Space between terms = AND (all must match):google phishingdomain:paypal secure loginissuer:encrypt staging api

All terms must appear somewhere in the certificate.

OR — alternatives

OR (uppercase) between groups:mycompany.com OR mycompany.iodomain:paypal OR domain:paypaiissuer:DigiCert OR issuer:Sectigo

Each OR group can contain AND terms and column filters.

NOT — exclusion

Prefix a term with - to exclude it:mycompany.com -stagingdomain:api -internal -testletsencrypt -wildcard

At least one positive term required per group.

Date filters — after: / before:

Certs seen after a date (inclusive):letsencrypt after:2024-06-01

Certs seen before a date (exclusive):domain:mycompany.com before:2024-01-01

Time window (both combined):issuer:DigiCert after:2024-01-01 before:2025-01-01

Full ISO timestamp:staging after:2024-06-01T00:00:00Z

Dates are UTC midnight. Timestamps are Unix seconds or ISO 8601. Date filters apply across all OR groups.

Practical CT monitoring examples

Typosquatting watch:domain:paypa OR domain:paypall OR domain:paypa1

Subdomain discovery:domain:mycompany.com -www -mail

Wildcard certs from a CA:cn:* issuer:Let's Encrypt

Phishing prep detection:domain:google -google.com OR domain:facebook -facebook.com

Recent certs for a domain:domain:mycompany.com after:2026-03-07

Total Certificates

11,803,199

Unique Issuers

144

Insert Rate

503.4/s

firehose

Uptime

47m 43s

Live Stream(click to expand)