Host response data

Validin's host response data captures how internet-facing services respond to HTTP and HTTPS requests at the time they are observed.

The dataset records server behaviour, response content, and transport configuration to support analysis of virtual hosts, exposed services, and infrastructure changes over time.

Data collection model

Validin collects host response data using active HTTP and HTTPS requests issued directly by Validin-controlled infrastructure.

Collection is performed against both:

• Virtual hosts resolved via DNS
• Raw IPv4 addresses discovered through scanning and enumeration

For each target:

1. Validin initiates an HTTP or HTTPS request
2. Validin captures the full response returned by the host
3. Validin stores response artifacts and derived fingerprints

📘

Note

Host response collection uses an emulated browser request model. Requests replicate initial browser behaviour over HTTP/1.x and do not execute client-side code.

Coverage scope

Validin performs internet-wide host response collection at scale.

Virtual host collection is driven by DNS resolution and SNI-aware HTTPS requests.

Request behaviour and redirects

For each request, Validin captures:

• The initial host response
• Up to three same-host redirects
• Final response content and headers

This provides visibility into how hosts redirect requests without following redirects to other domains.

Response artifacts collected

Validin stores multiple host response artifacts for each observation.

📘

Note

Only leaf certificates are stored. Intermediate and root certificates are not retained.

TLS and certificate data

For HTTPS services, Validin collects TLS configuration data and certificate features, including:

• Leaf certificate values
• Certificate metadata and hashes
• Server Name Indication (SNI)-specific certificates
• JARM fingerprints derived from multiple TLS negotiations

TLS fingerprinting is used to support identification of shared infrastructure and tooling.

Virtual host fingerprinting

Host response fingerprinting is based on three primary components:

Emulated browser model

Host response collection uses an emulated browser request pattern.

• Requests simulate initial browser behaviour
• Collection is performed over HTTP/1.x
• Client-side execution is not performed

This approach produces consistent responses without relying on full browser automation.

Port scanning integration

Host response data is complemented by recurring IPv4-wide port scanning.

Port scan results are correlated with:

• DNS resolution
• Host response fingerprints
• TLS and certificate data

This supports detection of newly exposed services and infrastructure changes.

Historical host response state

Validin maintains historical host response observations over time.

Historical data includes:

• First seen and last seen timestamps
• Response content changes
• Certificate rotation
• Configuration drift

This allows for the reconstruction of host behaviour at specific points in time.

Change tracking

Host response changes are recorded as individual observations over time:

Changes can be correlated across hosts, IPs, certificates, and fingerprints.

📘

Note

Tracking concurrent host response changes supports identification of infrastructure reuse and coordinated updates.

Data access in the platform

Host response data is exposed as queryable historical data, including:

• Current response artifacts
• Historical response timelines
• TLS and certificate features
• Host response fingerprints
• Correlated DNS and port scan context

Endpoint

HTML Response Features

HTTP Response Features

Certificate Features