Passive DNS Database Query via SecurityTrails

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTP requests made to the SecurityTrails API (api.securitytrails.com). SecurityTrails is a service that provides access to passive DNS databases and other domain-related intelligence. Such queries can indicate reconnaissance activity by an attacker or security researcher gathering information about a target domain.