How FullHunt builds internet intelligence.
FullHunt observes internet-facing hosts and domains, records what changes, adds vulnerability and exploit context, and delivers structured records through APIs and dedicated platforms.
- 2B+
- Internet hosts indexed
- 800M+
- CVE-to-host mappings
- 24 hours
- Average freshness cycle across continuously refreshed data
Coverage and update timing vary by dataset. Observation and update timestamps in the record show when a specific result was collected or enriched.
A scan result is an observation. FullHunt builds the record around it.
An open port alone has limited value. FullHunt ties the observation to a host, service, certificate, technology, organization, history, and relevant security context before it reaches a product or analyst.
- Observed on the internet
- Domains, subdomains, IP addresses, open ports, services, technologies, and TLS certificates.
- Normalized into a record
- Host and domain fields use consistent names and formats so they can be queried and joined across datasets.
- Enriched with security context
- CVEs, EPSS scores, CISA KEV status, public exploit references, passive DNS, organization relationships, and credential exposure where available.
- Kept with history
- First-seen, last-seen, and change data preserve the difference between a current observation and a historical relationship.
- Delivered to the user
- REST APIs, structured data feeds, Model Context Protocol, integrations, and the FullHunt Enterprise and MSSP platforms.
What is in the intelligence layer.
The fields below are available through different endpoints and delivery plans. The API contract for a product depends on the datasets, volume, and deployment model it needs.
Assets and services
Domains, subdomains, hosts, IP addresses, ports, protocols, service banners, technologies, and certificates.
Vulnerabilities
CVEs associated with observed software and services, plus validation status and affected-asset context where available.
Exploit context
EPSS scores, CISA KEV status, and public proof-of-concept and exploit references joined to CVE records.
Infrastructure history
Passive DNS relationships, first-seen and last-seen dates, and changes to services, certificates, and technologies.
Organization relationships
Relationships between organizations and observed domains, networks, and internet-facing infrastructure.
Credential exposure
Breached credentials and related dark-web records tied to monitored domains for enterprise and MSSP workflows.
How collection and updates work.
Different records change at different speeds. FullHunt keeps collection time, enrichment time, and historical state separate so users can judge the age and source of a result.
- Internet observations
- FullHunt revisits hosts and domains. Records keep observation and update timestamps when ports, services, technologies, or certificates change.
- Vulnerability and exploit context
- FullHunt joins CVE, EPSS, CISA KEV, and public exploit sources to applicable asset and software records. The record keeps source identifiers and enrichment time.
- Passive DNS and history
- Domain and IP relationships retain first-seen, last-seen, and relationship history.
- On-demand scans
- An authorized API or platform request starts collection for a permitted target. The result keeps request, completion, and result timestamps.
The output is structured for products and security operations.
Product teams can request the fields and delivery pattern their feature needs. Enterprise and MSSP teams can use the same underlying intelligence through purpose-built operating views.
- REST endpoints for host, domain, passive DNS, vulnerability, exploit, and OEM workflows
- Structured feeds for licensed datasets and higher-volume processing
- MCP access for authorized AI security workflows
- Dedicated deployment options for isolation and capacity requirements
{
"host": "vpn.example.com",
"ip_address": "203.0.113.42",
"ports": [443],
"technologies": ["nginx"],
"vulnerabilities": [
{
"cve": "CVE-2021-22893",
"cisa_kev": true,
"epss": 0.974
}
],
"first_seen": "2026-08-18T07:14:22Z",
"last_seen": "2026-09-01T06:52:10Z"
}
How to interpret a FullHunt record.
Observed facts
An IP address, open port, service response, or certificate is tied to the time it was observed. A later observation can change the current state without erasing the history.
Enriched context
Organization attribution, technology identification, CVE mapping, and exploit context are derived by joining observations with maintained signatures and external security sources.
Internet observations and enrichment can contain uncertainty. Consumers should use timestamps, source fields, and validation status when deciding how a record affects an automated workflow or analyst action.
Define the intelligence contract for your product.
Tell us which datasets, fields, volume, deployment preference, and launch date you are working with. We will map the endpoints and delivery model with your team.