osint reconnaissance

SecurityTrails Blog · Jan 08 · SecurityTrails team

New API Scroll Endpoint + Return IPs Feature Available

Here at SecurityTrails, we’re making our products smarter, stronger and easier to use every day. Thanks to valuable customer feedback and bold ideas from our own engineering and product management team, we are now introducing two new features to our powerful domain and IP intelligence API.

Read the API Changelog and you’ll see these important developments:

  • Scroll API endpoint
  • Ability to return IPs for A records on the Domain Search endpoint

We’ve added a new endpoint called “Scroll” that lets you perform scrolling over the Domain Search API (available for the DSL version). One of this features greatest benefits is that it allows you to fetch results easily through your API queries.

For example, we’ll use curl command to request data from the Domain Search API (DSL) while enabling the scroll=true option:

curl --request POST \
  --url 'https://api.securitytrails.com/v1/domains/list?apikey=YOUR.API.KEY&include_ips=false&scroll=true' \
  --data '{"query":"whois_email = '\''domain-contact_ww_grp@oracle.com'\''"}'

The output will include the new scrolling ID that can be then used in your DSL API endpoints:

"meta": {
  "total_pages": 21,
  "scroll_id": "DnF1ZxxxxFVNFnpObWlBT3M1VDZTVFozb1RObl81M0EAAAAAAD78VxZSSkpyVxmtRVnE2RmdnAAAAAAB[...]UtQcTFBAAAAAABGwgYWVWZoM3dTX3dRTS1UR2ZPQ0ZaRVh3dwAAAAAAQ47MFjdQbkZLWDBsUndtdHR6NW9LQjFwNVEAAAAAAHejuxY1ekN0YXE4OFItV2ZJTkkxcnl4TVRB",
  "query": "whois_email = 'domain-contact_ww_grp@oracle.com'",
  "page": 1
}

This endpoint has limited availability as it only works using the Search Domain (DSL) API.

Once you have the scroll_id, you can use it on new requests by adding the ID you got before, for example:

curl --request GET --url 'https://api.securitytrails.com/v1/scroll/SCROLL.ID?apikey=YOUR.API.KEY'

For every new request, a key will be returned, which will most likely be the same as the previous one. Once the scroll finishes it will let you know that it’s done. It’s also worth mentioning that scrolling will now yield 200 results per page instead of the usual 100 results.

Make sure to replace SCROLL.ID and YOUR.API.KEY with real values.

We’ve also introduced the ability to return IPs for A records on the Domain Search endpoint.

Just as we did before, let’s test this new feature by adding the include_ips=true option in the request:

curl --request POST --url "https://api.securitytrails.com/v1/domains/list?apikey=YOUR.API.KEY&include_ips=true" --heaer 'content-type: application/json' --data '{"filter":{"apex_domain":"google.com"}}'

The result will display the IP addresses included within the records, as shown here:

{
  "whois": {
    "registrar": null,
    "expiresDate": null,
    "createdDate": null
  },
  "mail_provider": [],
  "ips": [
    "216.58.217.115"
  ],
  "hostname": "pub-7567922491406405.afd.ghs.google.com",
  "host_provider": [
    "Google Inc."
  ],
  "computed": {
    "company_name": null
  },
  "alexa_rank": null
},

We are committed to building the best security toolkit for DNS, domain names and IP addresses. Stay tuned for more exciting API features and product news! Got a feature request? Use the chat feature on the bottom right to talk with us.


In the meantime, get your free API account today and start testing these amazing new API features to get fast and effective information about WHOIS, IP addresses, DNS records and domain names.