Examples

Retrieve stats on an IP

If you want to find out how many websites are hosted on an IP, the SecurityTrails API can output just the count.

curl --request POST \
  --url https://api.securitytrails.com/v1/search/list/stats \
  --header 'apikey: <<your_api_key>>' \
  --header 'content-type: application/json' \
  --data '{
	"filter": {
		"ipv4": "34.203.108.191"
	}
}'

wget --quiet \
  --method POST \
  --header 'content-type: application/json' \
  --header 'apikey: <<your_api_key>>' \
  --body-data '{\n	"filter": {\n		"ipv4": "34.203.108.191"\n	}\n}' \
  --output-document \
  - https://api.securitytrails.com/v1/search/list/stats

Find all the domains hosted currently on WIX name servers

You can find any domain that is hosted on a website builder, such as WIX by querying the domain search endpoint with the nameserver.

curl --request POST \
  --url https://api.securitytrails.com/v1/search/list \
  --header 'apikey: <<your_api_key>>' \
  --header 'content-type: application/json' \
  --data '{
	"filter": {
		"ns": "NS1.WIXDNS.NET"
	}
}'

wget --quiet \
  --method POST \
  --header 'content-type: application/json' \
  --header 'apikey: <<your_api_key>>' \
  --body-data '{\n	"filter": {\n		"ns": "NS1.WIXDNS.NET"\n	}\n}' \
  --output-document \
  - https://api.securitytrails.com/v1/search/list

Find all domains owned by email address

Searches all current WHOIS records for email address occurrence.

curl --request POST \
  --url https://api.securitytrails.com/v1/search/list \
  --header 'apikey: <<your_api_key>>' \
  --header 'content-type: application/json' \
  --data '{
	"filter": {
		"whois_email": "[email protected]"
	}
}'

wget --quiet \
  --method POST \
  --header 'content-type: application/json' \
  --header 'apikey: <<your_api_key>>' \
  --body-data '{\n	"filter": {\n		"whois_email": "[email protected]"\n	}\n}' \
  --output-document \
  - https://api.securitytrails.com/v1/search/list

Find the history where a domain was pointed

This can also be used to find out the original IP address for websites behind proxying services such as Cloudflare.

curl --request GET \
  --url https://api.securitytrails.com/v1/history/trello.com/dns/a \
  --header 'apikey: <<your_api_key>>'

wget --quiet \
  --method GET \
  --header 'apikey: <<your_api_key>>' \
  --output-document \
  - https://api.securitytrails.com/v1/history/trello.com/dns/a

Getting all domains that use a specific nameservers using the scroll API

If we want to get all domains currently hosted on ns1.yahoo.com, the first query looks like this:

curl --request POST \
  --url 'https://api.securitytrails.com/v1/domains/list?include_ips=false&page=1&scroll=true' \
  --data '{"query":"ns = '\''ns1.yahoo.com'\''"}'
  --header 'apikey: <<your_api_key>>'

The response will contain the first 200 results and metadata. The metadata section contains the scroll_id field, which can be used to retrieve all results. It is only valid for a couple of minutes.

You can now fire an API call to the scroll API

curl --request GET \
  --url 'https://api.securitytrails.com/v1/scroll/DnF1ZXJ5VGhlbk...<<SCROLLID>>...V3X2xQejRUdw=='
  --header 'apikey: <<your_api_key>>'

The returned result contains the second page. Each subsequently fired request yields another page, until the last page is reached.