It can be anything! An apex, subdomain, or even a URL.

Results for*.activaupdate.trendmicro.com

Logged At	Not Before	Not After	Common Name	Matching Identities	Issuer Name
2019-07-12T14:51:25.237	2019-07-04T13:37:10	2021-07-04T14:07:08	*.activaupdate.trendmicro.com	*.activaupdate.trendmicro.com	C=CA, O=AffirmTrust, OU=See www.affirmtrust.com/repository, CN=AffirmTrust Certificate Authority - OV1
2019-07-12T14:51:25.237	2019-07-04T13:37:10	2021-07-04T14:07:08	*.activaupdate.trendmicro.com	*.activaupdate.trendmicro.com	C=CA, O=AffirmTrust, OU=See www.affirmtrust.com/repository, CN=AffirmTrust Certificate Authority - OV1
2019-07-04T14:07:10.701	2019-07-04T13:37:10	2021-07-04T14:07:08	*.activaupdate.trendmicro.com	*.activaupdate.trendmicro.com	C=CA, O=AffirmTrust, OU=See www.affirmtrust.com/repository, CN=AffirmTrust Certificate Authority - OV1
2019-07-04T14:07:10.701	2019-07-04T13:37:10	2021-07-04T14:07:08	*.activaupdate.trendmicro.com	*.activaupdate.trendmicro.com	C=CA, O=AffirmTrust, OU=See www.affirmtrust.com/repository, CN=AffirmTrust Certificate Authority - OV1