The interesting hostnames are rarely in one log.
Deep mode merges a second certificate source and archive hostnames into the same list. It stays passive: the public sources are queried, never the target.
What this gives you
- Certificate transparency and Cert Spotter merged by hostname
- Archive hosts from the Wayback Machine CDX index
- Source attribution kept for every record
- Still passive. No probes, no brute force, no port scans
What deep mode adds
A single certificate log is incomplete by design. Deep mode widens the sources before it widens the request budget: one certificate-transparency request, plus two additive sources that are skipped cleanly if they are blocked.
Cert Spotter merge
A second certificate-transparency view. Any name it has that the primary missed is merged in with its own source label.
Wayback hostnames
Archived URLs reveal hosts that may never appear in a current certificate: staging systems, VPN portals and internal tools.
Deterministic merge
Records are keyed by hostname. The earliest first-seen date wins, wildcard flags are sticky, and every contributing source is kept.
- 01
Pick deep on the scan panel
The choice is stored in the URL, so a shared link repeats the same scan mode.
- 02
Sources are queried in one pass
Certificate transparency first, then Cert Spotter and the archive index in parallel. A failure in an additive source never discards what already parsed.
- 03
The list stays readable
Deduplicated hosts, source chips, first-seen dates and the same filters as a light scan. Nothing about triage changes.
Light or deep at a glance
Both modes end in the same explorer. Deep simply brings more public evidence to the first pass.
Light scan
One certificate-transparency request. Fastest path and the lowest source usage.
Deep scan
Same certificate-transparency request plus Cert Spotter and Wayback hostnames.
Both modes
Identical filters, previews, paths panel, exports and local cache.