SecurityTrails API™
Data for Security companies, researchers and teams. Fast, always up cyber security API that allows you to access current and historical data. The API is paid via a simple pricing structure that allows you to embed our data into your applications.
What can SecurityTrails API™ do?
DNS History
Request
curl --request GET \
--url https://api.securitytrails.com/v1/history/oracle.com/dns/a \
--header 'APIKEY: api.key.here' \
--header 'Accept: application/json'
Response
{
"records": [
{
"first_seen": "2018-06-08",
"organizations": [
"Comcast Cable Communications, LLC"
],
"last_seen": null,
"values": [
{
"ip": "104.70.75.9",
"ip_count": 1
}
]
},
{
"first_seen": "2018-06-07",
"organizations": [
"GTT Communications Inc."
],
"last_seen": "2018-06-08",
"values": [
{
"ip": "104.125.253.218",
"ip_count": 0
}
]
},
{
"first_seen": "2018-06-06",
"organizations": [
"Akamai International B.V."
],
"last_seen": "2018-06-07",
"values": [
{
"ip": "104.113.70.252",
"ip_count": 0
}
]
},
{
"first_seen": "2018-06-05",
"organizations": [
"Akamai International B.V."
],
"last_seen": "2018-06-06",
"values": [
{
"ip": "23.72.212.208",
"ip_count": 0
}
]
},
{
"first_seen": "2018-06-04",
"organizations": [
"Akamai International B.V."
],
"last_seen": "2018-06-05",
"values": [
{
"ip": "23.42.81.26",
"ip_count": 0
}
]
}
],
"pages": 9,
"endpoint": "\/v1\/history\/trello.com\/dns\/a",
"type": "a\/ipv4"
}
Subdomains
Request
curl --request GET \
--url 'https://api.securitytrails.com/v1/domain/oracle.com/subdomains?children_only=false& include_inactive=true' \
--header 'APIKEY: api.key.here' \
--header 'Accept: application/json'
Response
{
"endpoint": "\/v1\/domain\/trello.com\/subdomains",
"subdomains": [
"admin",
"api",
"blog",
"boards",
"c",
"e",
"em",
"email",
"help",
"info",
"internal",
"mail",
"spemail",
"sptrack",
"staging",
"status",
"support",
"tech",
"w",
"ww",
"www",
"wwww"
]
}
WHOIS History
Request
curl --request GET \
--url https://api.securitytrails.com/v1/domain/securitytrails.com/whois \
--header 'APIKEY: api.key.here'
Response
{
"result": {
"items": [
{
"ended": 1512131429698,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94105",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "registrant",
"telephone": "1877889455",
"street1": "375 Beale St., Suite 300",
"state": "CA"
},
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94105",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "1877889455",
"street1": "375 Beale St., Suite 300",
"state": "CA"
},
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94105",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "1877889455",
"street1": "375 Beale St., Suite 300",
"state": "CA"
},
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94105",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "technicalContact",
"telephone": "1877889455",
"street1": "375 Beale St., Suite 300",
"state": "CA"
}
],
"createdDate": 1193405489687,
"expiresDate": 1666791089687,
"updatedDate": 1472736689687,
"registrarName": "MARKMONITOR INC.",
"domain": "twilio.com",
"tld": "com",
"started": 1488372117378,
"status": [
"clientDeleteProhibited https:\/\/icann.org\/epp#clientDeleteProhibited",
"clientTransferProhibited https:\/\/icann.org\/epp#clientTransferProhibited",
"clientUpdateProhibited https:\/\/icann.org\/epp#clientUpdateProhibited"
],
"contactEmail": "[email protected]"
},
{
"ended": 1480570828696,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94107",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "registrant",
"telephone": "1877889455",
"street1": "645 Harrison Street, Third Floor",
"state": "CA"
},
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94107",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "1877889455",
"street1": "645 Harrison Street, Third Floor",
"state": "CA"
},
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94107",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "1877889455",
"street1": "645 Harrison Street, Third Floor",
"state": "CA"
},
{
"name": "Domain Administrator",
"fax": "1877889455",
"country": "UNITED STATES",
"postalCode": "94107",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "technicalContact",
"telephone": "1877889455",
"street1": "645 Harrison Street, Third Floor",
"state": "CA"
}
],
"createdDate": 1193381827942,
"expiresDate": 1666767427943,
"updatedDate": 1472713027942,
"registrarName": "MARKMONITOR INC.",
"domain": "twilio.com",
"tld": "com",
"started": 1480570828696,
"status": [
"clientDeleteProhibited https:\/\/icann.org\/epp#clientDeleteProhibited",
"clientTransferProhibited https:\/\/icann.org\/epp#clientTransferProhibited",
"clientUpdateProhibited https:\/\/icann.org\/epp#clientUpdateProhibited"
],
"contactEmail": "[email protected]"
},
{
"ended": 1472708410412,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS2.MYDYNDNS.ORG",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [
{
"name": "Domain Admin",
"city": "San Francisco",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"email": "[email protected]",
"type": "registrant",
"telephone": "18778894546",
"street1": "548 Market St.|#14510",
"state": "California"
},
{
"name": "Domain Admin",
"city": "San Francisco",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "18778894546",
"street1": "548 Market St.|#14510",
"state": "California"
},
{
"name": "Domain Admin",
"city": "San Francisco",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "18778894546",
"street1": "548 Market St.|#14510",
"state": "California"
},
{
"name": "Domain Admin",
"city": "San Francisco",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"email": "[email protected]",
"type": "technicalContact",
"telephone": "18778894546",
"street1": "548 Market St.|#14510",
"state": "California"
}
],
"createdDate": 1193398908552,
"expiresDate": 1445859708553,
"updatedDate": 1259062908552,
"registrarName": "GODADDY.COM, LLC",
"domain": "twilio.com",
"tld": "com",
"started": 1409565503690,
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"contactEmail": "[email protected]"
},
{
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"domain": "twilio.com",
"createdDate": 1193401738672,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS2.MYDYNDNS.ORG",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [
{
"type": "registrant",
"organization": "Twilio Inc.",
"name": "Domain Admin"
}
],
"updatedDate": 1259065738672,
"tld": "com",
"registrarName": "GODADDY.COM, LLC",
"expiresDate": 1445862538672,
"ended": 1398986973772,
"started": 1391256566158
},
{
"ended": 1383292780796,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS2.MYDYNDNS.ORG",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [
{
"city": "San Francisco",
"country": "United States",
"postalCode": "94104",
"organization": "Twilio Inc.",
"type": "registrant",
"street2": "#14510",
"street1": "548 Market St.",
"state": "California"
},
{
"state": "California",
"name": "Admin, Domain",
"country": "United States",
"postalCode": "94104",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "18778894546",
"street2": "#14510",
"street1": "548 Market St."
},
{
"state": "California",
"name": "Admin, Domain",
"country": "United States",
"postalCode": "94104",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "18778894546",
"street2": "#14510",
"street1": "548 Market St."
},
{
"state": "California",
"name": "Admin, Domain",
"country": "United States",
"postalCode": "94104",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "technicalContact",
"telephone": "18778894546",
"street2": "#14510",
"street1": "548 Market St."
}
],
"createdDate": 1193387917893,
"expiresDate": 1445848717893,
"updatedDate": 1259051917893,
"registrarName": "GODADDY.COM, LLC",
"domain": "twilio.com",
"tld": "com",
"started": 1383292780796,
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"contactEmail": "[email protected]"
},
{
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"domain": "twilio.com",
"createdDate": 1193389540651,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS2.MYDYNDNS.ORG",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [],
"updatedDate": 1259053540651,
"tld": "com",
"registrarName": "GODADDY.COM, LLC",
"expiresDate": 1445850340652,
"ended": 1375343965737,
"started": 1375343965737
},
{
"ended": 1363303077253,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS2.MYDYNDNS.ORG",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [
{
"city": "San Francisco",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"type": "registrant",
"street2": "#14510",
"street1": "548 Market St.",
"state": "California"
},
{
"state": "California",
"name": "Admin, Domain",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "18778894546",
"street2": "#14510",
"street1": "548 Market St."
},
{
"state": "California",
"name": "Admin, Domain",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "administrativeContact",
"telephone": "18778894546",
"street2": "#14510",
"street1": "548 Market St."
},
{
"state": "California",
"name": "Admin, Domain",
"country": "UNITED STATES",
"postalCode": "94104",
"organization": "Twilio Inc.",
"city": "San Francisco",
"email": "[email protected]",
"type": "technicalContact",
"telephone": "18778894546",
"street2": "#14510",
"street1": "548 Market St."
}
],
"createdDate": 1193360515572,
"expiresDate": 1445821315573,
"updatedDate": 1259024515573,
"registrarName": "GODADDY.COM, LLC",
"domain": "twilio.com",
"tld": "com",
"started": 1363303077253,
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"contactEmail": "[email protected]"
},
{
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"domain": "twilio.com",
"createdDate": 1193361084153,
"nameServers": [
"NS0.DNSMADEEASY.COM",
"NS1.DNSMADEEASY.COM",
"NS2.DNSMADEEASY.COM",
"NS2.MYDYNDNS.ORG",
"NS3.DNSMADEEASY.COM",
"NS4.DNSMADEEASY.COM"
],
"contact": [],
"updatedDate": 1259025084154,
"tld": "com",
"registrarName": "GODADDY.COM, LLC",
"expiresDate": 1445821884154,
"ended": 1347318661361,
"started": 1347318661361
}
],
"count": 19
},
"endpoint": "\/v1\/history\/twilio.com\/whois"
}
Associated Domains
Request
curl --request GET \
--url https://api.securitytrails.com/v1/domain/google.com/associated \
--header 'APIKEY: api.key.here'
Response
{
"records": [
{
"alexa_rank": 7493,
"whois": {
"createdDate": 1193437578000,
"registrar": "MarkMonitor Inc.",
"expiresDate": 1666823178000
},
"mail_provider": [
"Proofpoint, Inc."
],
"hostname": "twilio.com",
"host_provider": [
"Amazon.com, Inc."
],
"computed": {
"company_name": "Twilio Inc."
}
},
{
"alexa_rank": 65250,
"whois": {
"createdDate": 1076650657000,
"registrar": "MarkMonitor Inc.",
"expiresDate": 1613194657000
},
"mail_provider": [
"Google Inc."
],
"hostname": "authy.com",
"host_provider": [
"Cloudflare Inc"
],
"computed": {
"company_name": "Twilio Inc."
}
},
{
"alexa_rank": 681080,
"whois": {
"createdDate": 1378239527000,
"registrar": "MarkMonitor Inc.",
"expiresDate": 1567541927000
},
"mail_provider": [],
"hostname": "twiliocdn.com",
"host_provider": [],
"computed": {
"company_name": "Twilio Inc."
}
},
{
"alexa_rank": 773128,
"whois": {
"createdDate": 1321213111000,
"registrar": "MarkMonitor Inc.",
"expiresDate": 1542137911000
},
"mail_provider": [
"Google Inc."
],
"hostname": "kurento.org",
"host_provider": [
"Google Inc."
],
"computed": {
"company_name": "Twilio Inc."
}
},
{
"alexa_rank": null,
"whois": {
"createdDate": 1479278550000,
"registrar": "MarkMonitor Inc.",
"expiresDate": 1542350550000
},
"mail_provider": [],
"hostname": "2fanow.com",
"host_provider": [
"Akamai Technologies, Inc."
],
"computed": {
"company_name": "Twilio Inc."
}
}
],
"meta": {
"max_page": 3,
"total_pages": 3,
"query": "whois_email = '[email protected]'",
"page": 1
},
"record_count": 282,
"endpoint": "\/v1\/domain\/twilio.com\/associated"
}
IP Subnet
Request
curl --request POST \
--url https://api.securitytrails.com/v1/ips/stats \
--header 'APIKEY: api.key.here' \
--header 'Content-Type: application/json' \
--data '{
"query": "ip = '\''5.175.0.0/12'\''"
}'
Response
{
"ports": [
{
"key": 80,
"count": 35641
},
{
"key": 22,
"count": 8796
},
{
"key": 443,
"count": 7356
},
{
"key": 21,
"count": 4208
},
{
"key": 990,
"count": 356
},
{
"key": 11211,
"count": 36
},
{
"key": 6379,
"count": 23
},
{
"key": 9200,
"count": 15
},
{
"key": 5984,
"count": 11
}
],
"top_ptr_patterns": [
{
"key": "user-x-x-x-x.play-internet.pl",
"count": 65423
},
{
"key": "dynamic.isp.ooredoo.om",
"count": 60991
},
{
"key": "xxxxxxx.dynamic.spb.ertelecom.ru",
"count": 28582
},
{
"key": "xxxxxxx.dynamic.ekat.ertelecom.ru",
"count": 26284
},
{
"key": "xxxxxxx.dynamic.samara.ertelecom.ru",
"count": 24492
},
{
"key": "xxxxxxx.dynamic.nn.ertelecom.ru",
"count": 24488
},
{
"key": "xxxxxxx.dynamic.yar.ertelecom.ru",
"count": 16331
},
{
"key": "xxxxxxx.dynamic.barnaul.ertelecom.ru",
"count": 16327
},
{
"key": "xxxxxxx.dynamic.irkutsk.ertelecom.ru",
"count": 14285
},
{
"key": "xxxxxxx.dynamic.rostov.ertelecom.ru",
"count": 8875
},
{
"key": "dynamicip-xxxxxxx.pppoe.volgograd.ertelecom.ru",
"count": 8168
},
{
"key": "xxxxxxx.dynamic.perm.ertelecom.ru",
"count": 8162
},
{
"key": "xxxxxxx.dynamic.cheb.ertelecom.ru",
"count": 8159
},
{
"key": "xxxxxxx.dynamic.saratov.ertelecom.ru",
"count": 8159
},
{
"key": "xxxxxxx.dynamic.tver.ertelecom.ru",
"count": 7641
}
],
"endpoint": "\/v1\/ips\/stats",
"total": 457835
}
IP DSL queries are only available with our professional plan or higher.
PTR Search (stats)
Request
curl --request POST \
--url https://api.securitytrails.com/v1/ips/stats \
--header 'APIKEY: api.key.here' \
--header 'Content-Type: application/json' \
--data '{
"query": "ptr_part = 'stackoverflow.com'"
}
Response
{
"ports": [
{
"key": 443,
"count": 246
},
{
"key": 80,
"count": 79
},
{
"key": 22,
"count": 5
},
{
"key": 21,
"count": 2
}
],
"top_ptr_patterns": [
{
"key": "x-x.amazon.com",
"count": 6787
},
{
"key": "x-x-x-x.amazon.com",
"count": 3254
},
{
"key": "smtp-out-x-x.amazon.com",
"count": 662
},
{
"key": "freeip.amazon.com",
"count": 220
},
{
"key": "ns-x.amazon.com",
"count": 47
},
{
"key": "www.amazon.com",
"count": 44
},
{
"key": "luxx-br-dcr-rx-aex.amazon.com",
"count": 36
},
{
"key": "emailx.amazon.com",
"count": 19
},
{
"key": "mm-retail-out-x.amazon.com",
"count": 19
},
{
"key": "luxx-br-agg-rx-aex.amazon.com",
"count": 18
},
{
"key": "mm-notify-out-x-x.amazon.com",
"count": 17
},
{
"key": "sg-console-us-standard.console.aws.amazon.com",
"count": 16
},
{
"key": "smtp-fw-x.amazon.com",
"count": 16
},
{
"key": "sx-console-us-standard.console.aws.amazon.com",
"count": 16
},
{
"key": "mm-notify-out-x.amazon.com",
"count": 13
}
],
"endpoint": "\/v1\/ips\/stats",
"total": 11899
}
IP DSL queries are only available with our professional plan or higher.
Key features
DNS Record History
It’s all here, fully-indexed historic and current data, ready to be accessed asap.
Domain Historical WHOIS Data
Search nearly 3 billion historical and current WHOIS data and WHOIS changes.
Domain Names
Search our daily-updating database – it’s over 203 million deep and growing.
Website Technologies
Know what tech sites are running, and search by over a thousand technologies.
Passive DNS
Get monthly access to over 1 billion passive DNS datasets.
Instant IP & Domain search
Get the most current intel when it comes to IPs, domains, and hostnames in real-time.
Hostname Information
Get the scoop on www subs and all known subdomains.
Tagging
Searching is fast and simple with tagged and indexed intel.
All the data you need, all in one place
Tap into a treasure-trove of cyber security gold and get the info you can’t find anywhere else. We’re proud to offer security analysts and developers the most current DNS and domain intel with our powerful cybersecurity API.
-
10.19 Trillion
Historical DNS lookups
-
4.2 Billion
Historical WHOIS records
-
2.6 Billion
Total hostnames tracked
-
630 Million
Domains tracked
Our Security API makes it simple
Cyber Forensics
Find suspicious changes to DNS records and see how incidents correlate.
Brand Protection
Know instantly if your brand’s trademark or copyright is being used on fraudulent domains.
Threat Hunting
Track down command and control servers and get the latest malware info.
Crime Investigation
Gathering evidence has never been easier, follow the links and get all the facts.
Mergers and Acquisitions
Get the full picture when it comes to knowing an entity’s online assets and hidden details.
Powering Reputation Scoring Systems
Get the info that helps stop bad actors, know what domain and IPs they use and take charge.
Power Next-gen Firewalls
Big data makes for better security. Put reputation scoring and indexed intel to work in making your site more secure.
Online Fraud Investigation
Research fraudulent activity and have the intel needed to stop them in the future.
Whitepaper: Identifying a Company's Online Footprint
Learn how our algorithms uncover an organization's associated domains, IPs, and SSLs
Put our Security API Through its Paces
Use our security API to fetch domain and WHOIS data, and bring a whole new dimension to your datasets.