# Web IP: every host answering on ports 443 and 80

Web IP lists every host that answered TLS or HTTP on TCP port 443 or 80, with its certificate, JA3S, Server header, status, redirect and page title.

[Web IP](https://internetdata.io/databases/web-ip) is out, under Services: every host that answered a TLS handshake or an HTTP request on TCP port 443 or 80. A row is one address on one port, with the certificate it presented, the JA3S of its TLS handshake, the TLS and HTTP versions it negotiated, and the status, `Server` header, redirect, cookie names and page title of its first response. A port that was open but never answered isn't in the file.

## One response per row

| Address | Port | Status | `server` | Certificate | Title |
|---|---|---|---|---|---|
| `3.96.111.78` | 443 | 403 | `awselb/2.0` | `welbi.host`, issued by Amazon | 403 Forbidden |
| `47.253.191.243` | 443 | 200 | `nginx/1.24.0 (Ubuntu)` | `www.xmgsgroup.com`, issued by DigiCert | GSG-Tech Domain Updated \| GSG-Tech |
| `163.172.175.84` | 443 | 404 | | `TRAEFIK DEFAULT CERT`, self-signed | |
| `51.38.39.174` | 80 | 200 | `Apache/2.4.58 (Ubuntu)` | | Apache2 Ubuntu Default Page: It works |

On 443 a row also carries the certificate's validity dates, its SHA-256 fingerprint, every name it covers and whether a browser trusts it, and the cipher the server chose.

## In the first build

Of the hosts that completed a TLS handshake on 443 in the October 8 build:

| | Share |
|---|---|
| Negotiated TLS 1.3 | 70.0% |
| Negotiated TLS 1.2 | 25.0% |
| Negotiated TLS 1.0 or 1.1 | 0.66% |
| Presented a browser-trusted certificate | 65.3% |
| Presented a self-signed certificate | 14.5% |
| Presented an expired certificate | 10.5% |

Let's Encrypt issued 30.2% of the browser-trusted certificates, Amazon 25.0% and DigiCert 17.6%. 44.4% of the hosts that sent an HTTP response on 443 spoke HTTP/2. On port 80, `nginx` leads the `Server` header at 23.4%, ahead of `AkamaiGHost` at 11.8% and `Apache` at 11.6%, and 17.8% send none.

## One server across many addresses

A certificate fingerprint groups hosts by what they run rather than where they sit: 55.7% of TLS hosts present a certificate at least one other host presents too, so `cert_fp_sha256` follows one deployment across every address it answers on. JA3S is coarser. 320 distinct values cover every TLS host in the build, since it fingerprints a TLS stack and its settings rather than a server, so it narrows a certificate match instead of replacing one.

The same columns find exposure. 0.98% of TLS hosts present a certificate issued to a private address such as `192.168.1.1`, and 0.43% one issued to `localhost`: certificates made for a device on a local network, answering from a public address. 2.1% of HTTP responses are nginx's "Welcome to nginx!" default page, and 0.2% a bare `Index of /` directory listing.

Its siblings under Services, [SSH IP](https://internetdata.io/databases/ssh-ip), [SMTP IP](https://internetdata.io/databases/smtp-ip) and [DNS Resolver IP](https://internetdata.io/databases/dns-resolver-ip), do the same for SSH, mail submission and DNS.

## Getting access

Web IP ships as CSV, rebuilt weekly, and its [docs page](https://docs.internetdata.io/database/web-ip) has the schema. [Sign up](https://app.internetdata.io/auth/signup) to evaluate it from its sample. A license is per database and never metered: see [licensing](https://internetdata.io/pricing), or [talk to us](https://internetdata.io/contact) about what you need.