Web IP is out, under Services: every host that answered a TLS handshake or an HTTP request on TCP port 443 or 80. A row is one address on one port, with the certificate it presented, the JA3S of its TLS handshake, the TLS and HTTP versions it negotiated, and the status, Server header, redirect, cookie names and page title of its first response. A port that was open but never answered isn't in the file.
One response per row
| Address | Port | Status | server | Certificate | Title |
|---|---|---|---|---|---|
3.96.111.78 | 443 | 403 | awselb/2.0 | welbi.host, issued by Amazon | 403 Forbidden |
47.253.191.243 | 443 | 200 | nginx/1.24.0 (Ubuntu) | www.xmgsgroup.com, issued by DigiCert | GSG-Tech Domain Updated | GSG-Tech |
163.172.175.84 | 443 | 404 | TRAEFIK DEFAULT CERT, self-signed | ||
51.38.39.174 | 80 | 200 | Apache/2.4.58 (Ubuntu) | Apache2 Ubuntu Default Page: It works |
On 443 a row also carries the certificate's validity dates, its SHA-256 fingerprint, every name it covers and whether a browser trusts it, and the cipher the server chose.
In the first build
Of the hosts that completed a TLS handshake on 443 in the October 8 build:
| Share | |
|---|---|
| Negotiated TLS 1.3 | 70.0% |
| Negotiated TLS 1.2 | 25.0% |
| Negotiated TLS 1.0 or 1.1 | 0.66% |
| Presented a browser-trusted certificate | 65.3% |
| Presented a self-signed certificate | 14.5% |
| Presented an expired certificate | 10.5% |
Let's Encrypt issued 30.2% of the browser-trusted certificates, Amazon 25.0% and DigiCert 17.6%. 44.4% of the hosts that sent an HTTP response on 443 spoke HTTP/2. On port 80, nginx leads the Server header at 23.4%, ahead of AkamaiGHost at 11.8% and Apache at 11.6%, and 17.8% send none.
One server across many addresses
A certificate fingerprint groups hosts by what they run rather than where they sit: 55.7% of TLS hosts present a certificate at least one other host presents too, so cert_fp_sha256 follows one deployment across every address it answers on. JA3S is coarser. 320 distinct values cover every TLS host in the build, since it fingerprints a TLS stack and its settings rather than a server, so it narrows a certificate match instead of replacing one.
The same columns find exposure. 0.98% of TLS hosts present a certificate issued to a private address such as 192.168.1.1, and 0.43% one issued to localhost: certificates made for a device on a local network, answering from a public address. 2.1% of HTTP responses are nginx's "Welcome to nginx!" default page, and 0.2% a bare Index of / directory listing.
Its siblings under Services, SSH IP, SMTP IP and DNS Resolver IP, do the same for SSH, mail submission and DNS.
Getting access
Web IP ships as CSV, rebuilt weekly, and its docs page has the schema. Sign up to evaluate it from its sample. A license is per database and never metered: see licensing, or talk to us about what you need.
