Know what every hostname in your traffic is
2.7 billion SNIs and hostnames, each with its IAB category, the job the server does, the company behind it and its infrastructure provider. Built for firewalls, DNS filters and network monitoring, where the hostname is often the only thing you can see.
Download free sample (1,000 rows) Request a quoteWhat your network sees, and what we add
Why a hostname database, and not only domains
Most traffic is encrypted, so a firewall or monitoring tool usually sees one thing: the server name the device asks for. That name is rarely the website itself. Opening one news page can touch twenty hostnames for images, video, ads, analytics and sign-in.
Category for every hostname
Each hostname carries the IAB category of the service behind it, so img.ma-shops.de counts as the antiques shop it serves, not as an unknown image server.
The job the server does
A traffic role separates what people actually visit from background traffic: content delivery, application interfaces, ads and tracking, sign-in, email, updates and more.
Who is behind it
The owner column names the company a hostname belongs to, and the infrastructure provider column shows shared hosting and content networks where the customer is not visible.
Test and staging servers
A non-production flag marks development, test and staging hostnames, which many teams want to report on separately or leave out.
What the rows look like
These rows come from the free sample. The sample has 1,000 hostnames with all 11 columns, in the same format as the full database.
| SNI / hostname | Root domain | Category (IAB) | Role | Owner | Infrastructure provider |
|---|---|---|---|---|---|
| www.european.air.express.de | express.de | News | website | express.de | - |
| img.ma-shops.de | ma-shops.de | Hobbies & Interests > Antiquing and Antiques | cdn | ma-shops.de | - |
| api-ebanking.at.ing.be | ing.be | Business and Finance > Industries > Financial Industry | api | ing.be | - |
| mail.maillist.xdf.cn | xdf.cn | Education | xdf.cn | - | |
| analytics.native-instruments.com | native-instruments.com | Technology & Computing > Computing > Computer Software and Applications > Digital Audio | ads_tracking | native-instruments.com | - |
| contrataciones-qa-sso.telmex.com | telmex.com | Personal Finance > Home Utilities > Internet Service Providers | login | telmex.com | - |
| ns848.hostgator.com.br | hostgator.com.br | Technology & Computing > Computing > Internet | network | hostgator.com.br | - |
| monitor.laguida.it | laguida.it | News | telemetry | laguida.it | - |
| dl.apteka911.ua | apteka911.ua | Medical Health > Pharmaceutical Drugs | download_update | apteka911.ua | - |
| vpn.pami.org.ar | pami.org.ar | Business and Finance > Industries > Healthcare Industry | remote_access | pami.org.ar | - |
| push.ariva.de | ariva.de | Business and Finance > Industries > Financial Industry | push_chat | ariva.de | - |
| burk-io-blog.s3.wasabisys.com | wasabisys.com | Technology & Computing > Computing > Internet > Cloud Computing | cloud_hosting | unknown | Wasabi |
Also in every row: all categories with confidence, the method that gave the category, a role confidence and the non-production flag.
Download the 1,000-row sampleThe traffic roles
The role tells you what a connection is for. It is what lets a policy treat a sign-in server differently from an ad server on the same domain, and what keeps background traffic out of your browsing reports.
Pages people open and read.
Content delivery: images, video, scripts and files.
Application interfaces that apps and sites call.
Advertising, analytics and tracking servers.
Sign-in and single sign-on services.
Mail servers and webmail.
Usage, crash and performance reporting.
Software downloads and update servers.
VPN gateways and remote desktop.
Real-time messaging and push notifications.
Name servers, proxies, gateways and time servers.
Storage and hosting where the customer is not visible.
Where teams use it
Firewalls and web gateways
Write policies by category and role on encrypted traffic, without breaking it open: block a category, allow its sign-in servers, rate-limit its content delivery.
DNS filtering
Every DNS query names a hostname. The database turns those names into categories at the resolver, including the many subdomains a plain domain list misses.
Network monitoring and analytics
Report what people actually use, with content delivery, tracking and update traffic grouped separately instead of inflating the numbers.
Security operations
Give analysts instant context for an unfamiliar hostname: what the service is, who runs it, and whether it is a test server or production.
Internet providers and carriers
Categorize subscriber traffic at scale for reporting, parental controls and network planning.
Hostnames that are not in the database
New hostnames appear every day, so the database comes with an offline engine that runs on your own servers. It categorizes any hostname, listed or not, at more than 100,000 hostnames per second on a standard 12-core server.
Engine Offline, included
For a hostname that is not listed, the engine looks up its root domain in our 120 million domain database, gives the hostname that category and assigns a traffic role. It makes no network calls at all.
Optional live checks, in your network
An optional second engine checks unknown hosts live through your own proxy and resolver. It adds a status (live, unresolvable, parked) and roles for hosts whose name does not show one. Nothing is sent to us.
Freshness and delivery
Kept current
- 300,000 newly registered domains reviewed every day, across all top-level and country domains
- New domains reviewed again after one week and one month, when sites add their content
- Weekly update files with new and changed hostnames, daily files on request
- A full snapshot every quarter
Delivered your way
- CSV or Parquet files, one row per hostname
- The full 2.7 billion rows, or slices by top-level domain, country, category or role
- Delivery by secure download link
- Licenses for use in your own network, or for products you sell
Questions
What is an SNI?
The Server Name Indication is the hostname a device sends when it opens an encrypted connection. Firewalls, DNS filters and network monitors can read it even when the rest of the traffic is encrypted, which makes it the most useful label for traffic you cannot inspect.
How is this different from your domain database?
The domain database categorizes 120 million websites. This database goes one level deeper: it lists the hostnames under those domains, the ones your network actually sees, and adds a role, an owner and an infrastructure provider for each.
What happens with hostnames that are not in the database?
The offline engine that comes with the database looks up the root domain in our 120 million domain database and gives the hostname that category and a traffic role. It runs on your servers and sends nothing to us.
How often is it updated?
Weekly update files list new and changed hostnames, daily files are available on request, and a full snapshot is delivered every quarter.
Does it work with the web filtering categories too?
The hostname database uses the IAB Content Taxonomy. If your policies are built on web filtering categories, combine it with our web filtering database, which uses the same root domains as its key.
How is it priced?
By quote. The price depends on the number of hostnames, the slices you need, the update cadence and whether the data is used inside your own network or in a product you sell.
Get a quote for the SNI/Hostname Database
Tell us roughly how many hostnames you need, which slices and how often you want updates. We reply within one business day.