It can be anything! An apex, subdomain, or even a URL.

Results forexpired-root13.geotrust.com

Logged At	Not Before	Not After	Common Name	Matching Identities	Issuer Name
2018-11-29T21:36:41.008	2017-05-09T00:00:00	2017-05-10T23:59:59	expired-root13.geotrust.com	expired-root13.geotrust.com	C=US, O=GeoTrust Inc., CN=GeoTrust Extended Validation SHA256 SSL CA
2017-05-09T17:18:32.695	2017-05-09T00:00:00	2017-05-10T23:59:59	expired-root13.geotrust.com	expired-root13.geotrust.com	C=US, O=GeoTrust Inc., CN=GeoTrust Extended Validation SHA256 SSL CA
2017-05-03T19:45:17.323	2017-05-03T00:00:00	2018-05-03T23:59:59	expired-root13.geotrust.com	expired-root13.geotrust.com	C=US, O=GeoTrust Inc., CN=GeoTrust Extended Validation SHA256 SSL CA