Securitytrails

@securitytrails what SSL certificates are currently active for example.com and when do they expire?

SecurityTrails returned SSL certificate details for example.com. The current certificate is issued by Let's Encrypt, valid from January 15, 2025 to April 15, 2025 (expires in 47 days). Subject Alternative Names include www.example.com and api.example.com. Historical records show three prior certificates dating back to 2022, all using Let's Encrypt with 90-day validity periods. No expired certificates are currently serving traffic.

This example demonstrates SSL certificate enumeration, useful for security audits and expiration tracking. Requires API key authentication. Historical data depth depends on your SecurityTrails subscription tier; free accounts see limited history. Use this to monitor certificate rotation patterns or identify misconfigured domains.

@securitytrails find all IP addresses associated with acme-corp.com and group them by ASN

SecurityTrails identified 47 IP addresses linked to acme-corp.com. Grouped by Autonomous System: AS16509 (Amazon) hosts 31 IPs in us-east-1 and us-west-2 regions. AS15169 (Google Cloud) hosts 12 IPs in us-central1. AS13335 (Cloudflare) hosts 4 IPs serving CDN traffic. All IPs resolved within the last 30 days. Two legacy IPs in AS7018 (AT&T) appear inactive since November 2024.

This read-heavy example shows infrastructure mapping across cloud providers. Useful for attack surface enumeration or validating migration completeness. Results reflect DNS resolution history in SecurityTrails' database, not real-time scanning. Large enterprises may return hundreds of IPs; consider pagination for bulk analysis.

@securitytrails add monitoring rules to flag any new subdomains under *.internal.example.com in our ASI project

SecurityTrails queued 1 static asset rule for project ID proj_abc123. Rule configuration: monitor all subdomains matching *.internal.example.com, trigger alerts on new DNS A/AAAA records. Batch operation accepted; processing asynchronously. Verify rule activation by checking the Get Static Assets endpoint in 2-3 minutes. Once active, you'll receive notifications when SecurityTrails detects new subdomains in this namespace during its next crawl cycle (typically 24-48 hours).

This write example demonstrates proactive subdomain monitoring setup. The bulk rules tool supports up to 1000 rules per batch but processes asynchronously—immediate confirmation doesn't guarantee the rule is live. Requires an active ASI (Attack Surface Intelligence) subscription. Alerts depend on SecurityTrails' crawl frequency, not real-time DNS monitoring.

When SecurityTrails wins for tracing attack infrastructure

A 6-person security team investigating a phishing campaign needs to map the attacker's infrastructure in under an hour. SecurityTrails is the right call here: the Get Company Associated IPs and Get Domain tools let you pivot from a single suspicious domain to the full IP block and related hostnames in minutes, not days. The 12-tool scope gives you SSL history (Get Domain SSL) to spot certificate reuse patterns across campaigns. The trade-off: if you're triaging more than 50 domains per incident, the API rate limits slow you down—batch the lookups or use the Scroll Results tool to paginate large queries. For small-team IR where speed matters more than exhaustive coverage, this MCP closes the attribution loop fast.

When this MCP speeds up third-party risk assessment

A 3-person compliance team vetting 20 SaaS vendors per quarter can use SecurityTrails to automate the DNS and SSL hygiene checks that usually eat half a workday per vendor. The Get Domain and Get Domain SSL tools surface expired certificates, misconfigured DNS, and IP reputation flags without manual recon. The Ping tool confirms your API key works before you queue the batch. The limitation: SecurityTrails doesn't score or rank findings—you still need a human to decide if a vendor's subdomain sprawl is a red flag or just messy housekeeping. If your vendor list is under 30 domains per review cycle and you already have a scoring rubric, this MCP cuts the data-gathering phase from hours to minutes.

When this MCP fits ongoing typosquatting watch

A 2-person legal ops team at a fintech monitoring 200 lookalike domains for trademark abuse can use SecurityTrails to automate the weekly check for new registrations or SSL changes. The Get Domain tool pulls current DNS stats; the Scroll Results tool handles pagination when your watchlist grows past 100 entries. The Bulk Static Asset Rules tool lets you tag high-risk domains for faster triage next cycle. The catch: SecurityTrails doesn't alert you when a domain changes—you're polling, not streaming. If you need real-time notifications or your watchlist exceeds 500 domains, you'll hit API quota walls and need a dedicated monitoring service. For small teams running weekly or monthly sweeps on a manageable list, this MCP turns a spreadsheet slog into a 15-minute Switchy workflow.