I Built a Tool to Watch .ie Domains Register in Real-Time

A while back I started wondering: how many .ie domains actually get registered each day? Not just the big launches you'd hear about — all of them. The quiet ones. The subdomains. The wildcards. I wanted to see the Irish internet growing in real-time.

So I built .ie Finder — a Python tool that monitors certificate transparency logs and surfaces every new .ie domain as it gets issued a TLS certificate.

How It Works

.ie Finder connects to CertStream by Calidog Security, a service that aggregates certificate transparency logs from the big players — Google's Argon, Cloudflare's Nimbus, and others — and streams them over a WebSocket. Every time a new certificate is issued anywhere on the internet, I check whether the domain ends in .ie. If it does, I log it.

It's about as close to real-time .ie domain monitoring as you can get without direct access to the IE Domain Registry's own systems.

What It Logs

Running the tool, you see a live stream of domains appearing:

[2025-02-27 00:04:05] old.idpd.ecoserve.ie
[2025-02-27 00:04:09] www.icecompanyinc.ie
[2025-02-27 00:05:06] qjcmekguojdoy8w.mail.yt.m3dia.ie
[2025-02-27 00:05:11] quantumfulfilment.ie
[2025-02-27 00:05:11] *.tiltinsurance.ie
[2025-02-27 00:05:12] help.apexit.ie
[2025-02-27 00:05:14] draft.kmk.ie
[2025-02-27 00:05:39] *.ruby-consulting.ie
[2025-02-27 00:06:13] driveinc.ie

Beyond the live output, the tool writes to five log files in a logs/ directory:

certstream.log — raw CertStream library output
log.txt — full domain names, subdomains included
domains.txt — cleaned base .ie domain names only
domains.csv — timestamped entries, useful for analysis
www.txt — just the www.-prefixed domains

I also added a --verbose flag if you want to watch the full firehose of every TLD passing through, not just .ie.

Getting It Running

It's a straightforward Python setup:

$ python3 -m venv .venv
$ source .venv/bin/activate
$ pip install -r requirements.txt
$ python3 ieFinder.py

You'll need Python 3.x. That's it.

One Caveat: CertStream Reliability

The default CertStream server (certstream.calidog.io) is a free demo instance, and it can be unreliable — disconnects happen, and sometimes there are periods with no data at all. If you connect and see No data received from CertStream, the server is likely down rather than anything being wrong with the tool itself.

My workaround for this is self-hosting. There's a brilliant Go-based drop-in replacement called certstream-server-go that you can spin up with Docker in seconds:

$ docker run -p 8080:8080 0rickyy0/certstream-server-go

Then just update the WebSocket URL in ieFinder.py to point at wss://localhost:8080/ and you're fully independent.

Credit Where It's Due

ie Finder is heavily based on certSniff by A-poc. I adapted it to focus specifically on .ie domains.

The code is on GitHub if you want to have a poke around or contribute. It's been a surprisingly satisfying thing to leave running in a terminal — there's something oddly compelling about watching the Irish internet tick over in real-time.