Passive OSINT & Recon API
The Passive OSINT & Recon API returns passive subdomain and infrastructure discovery as clean JSON.
🤖 Using an AI assistant? Copy this link into ChatGPT / Claude / Cursor — it reads every endpoint and parameter instantly and tells you if this API fits your use case.
The primary subdomains endpoint returns a domain's discovered subdomains (sorted and unique), a per-source matrix, per-source status and a coverage summary — all from passive sources, with no active scanning. You can also enrich a domain or an IP and batch many targets. It is built for security research, attack-surface mapping and recon workflows that need passive OSINT without running intrusive scans. One ReefAPI key, one shared credit pool, the standard envelope.
Five sources, wildly uneven yield, and the matrix that shows it
The subdomain list is a union of five independent public indexes, and they do not contribute equally. Every response carries sources{} with a per-source ok flag, count and note, plus source_matrix{} mapping each hostname to the sources that saw it, so you can tell a well-corroborated host from one that a single archive remembers. The numbers below are a single measured run against hackerone.com.
| Source | What it indexes | Measured yield on hackerone.com |
|---|---|---|
| otx | AlienVault/LevelBlue OTX passive DNS plus its URL list | 82 of the 82 hosts in the union |
| hackertarget | hostsearch, free tier | 10 hosts; a repeat run minutes later returned 11 |
| certspotter | Cert Spotter certificate-transparency issuances | 9 hosts |
| wayback | Wayback Machine archived-host index | 2 hosts |
| crtsh | crt.sh certificate-transparency logs | 0, with ok:false and note "crt.sh HTTP 502 (flaky CT endpoint) - degraded" |
| union | deduplicated and sorted | count 82, matching the returned subdomains array length |
| confidence | a word, not a number | "high" on dns and ssl, "medium" on subdomains_passive, archive, threat_flags, dns_history and associated_domains |
| meta.sections | per-section status on the domain action | ok for six sections, "empty" for associated_domains, so a blank section is labelled rather than silent |
Restricting sources is a good way to get nothing. A run with sources=crtsh alone returned ok:true, count 0, an empty subdomains array and an empty source_matrix, because the one source selected was the one that was degraded that day. Unless you have a reason, leave sources at its default of all five and read the sources{} block to see which ones actually answered.
Real request and response JSON
Captured from the indexed primary action, subdomains, on .
{
"method": "POST",
"url": "https://api.reefapi.com/passive-osint/v1/subdomains",
"headers": {
"x-api-key": "$REEF_KEY",
"content-type": "application/json"
},
"body": {
"domain": "hackerone.com"
}
}{
"ok": true,
"meta": {
"api": "passive-osint",
"endpoint": "subdomains",
"mode": "live",
"latency_ms": 18034.7,
"record_count": 11,
"bytes": 8920,
"cache_hit": false,
"sources_succeeded": [
"certspotter",
"hackertarget"
],
"capped": false
},
"data": {
"domain": "hackerone.com",
"subdomains": [
"a.ns.hackerone.com",
"api.hackerone.com",
"b.ns.hackerone.com"
],
"count": 11,
"source_matrix": {
"hackerone.com": [
"certspotter"
],
"api.hackerone.com": [
"certspotter",
"hackertarget"
],
"support.hackerone.com": [
"certspotter",
"hackertarget"
],
"www.hackerone.com": [
"certspotter",
"hackertarget"
],
"mta-sts.hackerone.com": [
"certspotter",
"hackertarget"
],
"gslink.hackerone.com": [
"certspotter",
"hackertarget"
],
"mta-sts.forwarding.hackerone.com": [
"certspotter",
"hackertarget"
],
"mta-sts.managed.hackerone.com": [
"certspotter",
"hackertarget"
],
"docs.hackerone.com": [
"certspotter",
"hackertarget"
],
"a.ns.hackerone.com": [
"hackertarget"
],
"b.ns.hackerone.com": [
"hackertarget"
]
},
"sources": {
"crtsh": {
"ok": false,
"count": 0,
"note": "source timed out after 18s (slow upstream — partial result returned)"
},
"certspotter": {
"ok": true,
"count": 9,
"note": null
},
"otx": {
"ok": false,
"count": 0,
"note": "source timed out after 18s (slow upstream — partial result returned)"
},
"hackertarget": {
"ok": true,
"count": 10,
"note": null
},
"wayback": {
"ok": false,
"count": 0,
"note": "source timed out after 18s (slow upstream — partial result returned)"
}
},
"coverage_note": "Passive discovery aggregates public CT logs, passive-DNS and archive indexes. It is inherently PARTIAL and the passive ecosystem is FRAGMENTED — each source samples a different slice (live measurement: independent aggregators and our sources overlap only partially), so aggregating many sources maximises coverage but CANNOT claim a complete inventory. Active brute-force/zone-transfer would be needed for completeness and is out of scope. Sources that returned data: certspotter, hackertarget."
}
}What the Passive OSINT & Recon API does
| Action | Description | Concrete use case | Key params |
|---|---|---|---|
| subdomains | Passive subdomain discovery across crt.sh + certspotter + OTX + hackertarget + Wayback, deduped, with a per-source matrix and an honest coverage note | Platform and DevOps teams call subdomains to get passive subdomain discovery across crt.sh + certspotter + OTX + hackertarget + Wayback, dedup…. | domain, sources |
| domain | One-call unified passive report: subdomains + DNS summary + SSL summary + archive first/last-seen + threat blocklist flags, each section degrading independently | Security and supply-chain teams call domain to get one-call unified passive report. | domain, sources, include_pii |
| ip | Passive IP enrichment: rDNS (PTR) + ASN/org/country (Team-Cymru + RDAP) + threat blocklist flags + shared-host neighbours (reverse-IP + OTX IPv4 passive-DNS) | Developer-tool builders call ip to get passive IP enrichment. | ip, include_pii |
| batch | Compact passive report (subdomain count+list, DNS, threat, archive-first-seen) across up to 10 domains in one call | AI-agent developers call batch to get compact passive report (subdomain count+list, DNS, threat, archive-first-seen) across up to 1…. | domains |
Call subdomains from your stack
curl -X POST https://api.reefapi.com/passive-osint/v1/subdomains \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"domain":"hackerone.com"}'import requests
r = requests.post(
"https://api.reefapi.com/passive-osint/v1/subdomains",
headers={"x-api-key": REEF_KEY},
json={
"domain": "hackerone.com"
},
)
print(r.json()["data"])const res = await fetch("https://api.reefapi.com/passive-osint/v1/subdomains", {
method: "POST",
headers: {
"x-api-key": process.env.REEF_KEY,
"content-type": "application/json",
},
body: JSON.stringify({
"domain": "hackerone.com"
}),
});
const { ok, data, meta, error } = await res.json();Ask your MCP-connected assistant: call reefapi.passive-osint.subdomains with {"domain":"hackerone.com"}.Who uses this API and why
- Security teams call subdomains to map an organization's external attack surface passively.
- Recon workflows use domain and ip to enrich a target with infrastructure context.
- Threat-intel tools use batch to run passive discovery across many domains at once.
Questions developers ask before integrating
Why is batch so much shallower than the single-domain call?
Because it queries fewer sources. In back-to-back measurements the subdomains action returned 82 hosts for hackerone.com while the batch action returned subdomain_count 11 for the same domain, with sources_succeeded listing only certspotter and hackertarget. batch also returned archive_first_seen null where the domain action returned 2005-02-09T16:19:15Z. batch is a compact triage pass over up to 10 domains, not a cheaper way to run the same query. Do not compare a batch count against a single-domain count.
One source produced all 82 hosts. Should I just use that one?
No, because which source carries a domain is not predictable. On hackerone.com otx returned all 82 while certspotter returned 9, hackertarget 10 and wayback 2, and crt.sh was down entirely. On another domain the shape will differ, and certificate-transparency sources see hosts that passive DNS never resolved. Read source_matrix per host instead: a hostname listed by certspotter, otx and hackertarget is far better corroborated than one seen only by wayback, which may be an archived host that no longer exists.
What does this engine refuse to do?
Person OSINT, explicitly and at the parameter level. Passing an email alongside a domain returned ok:false with error.code INVALID_PARAM and the message "'email' is out of scope: passive-osint is domain/IP-only and deliberately does NOT do person OSINT (email/phone/username/social). Use a domain or ip parameter." It also does no active scanning: no brute force, no zone transfer, no port scan. Everything comes from public indexes that already hold the data, which is why it is safe to run against a target you do not own.
How complete is the subdomain list?
Not complete, and the response says so in coverage_note rather than in the docs alone. The note describes the passive ecosystem as fragmented, states that aggregating many sources maximises coverage but cannot claim a complete inventory, and points out that active brute force or a zone transfer would be needed for completeness and is out of scope. The batch action carries a blunter version: roughly 60 to 90 percent of live inventory per domain. Treat the output as an attack-surface starting point, not an asset register.
What does the ip action add that a WHOIS lookup does not?
Neighbours and history. A measured 8.8.8.8 lookup returned rdns.ptr ["dns.google"], network {asn 15169, as_name "GOOGLE - Google LLC, US", bgp_prefix 8.8.8.0/24, country US, registry arin, network_name GOGL, org "Google LLC"}, clean threat_flags across feodo, sslbl and spamhaus_drop, and a shared_host block with shown 200, approx_total 500 and is_shared true. The note on that block is the important part: a shared or CDN IP lists many unrelated domains and that is not an ownership link.
Why do two identical calls return slightly different data?
Because the upstream indexes are live and unordered. Two runs on hackerone.com minutes apart returned hackertarget counts of 10 and then 11, and the dns block returned its a, mx and ns arrays in a different order each time with the same members. Sort before you diff, and compare on set membership rather than on array position. Section-level failures also move between runs, which is exactly what the per-source ok flags and meta.sections are there to record.
What is dns_history, and why do its timestamps look different?
It is passive-DNS resolution history: when each hostname-to-IP mapping was first and last observed. A measured hackerone.com report returned count 155 with rows such as {hostname docs.hackerone.com, record_type AAAA, address 2a06:98c1:310c::6812:24d6, first_seen 2026-08-02T19:56:09, last_seen 2026-08-25T20:14:38}. Those timestamps carry no timezone suffix, while the ssl and archive sections return proper Z-suffixed UTC. Normalize before you sort a mixed timeline. The source is otx-passive-dns and confidence is medium.
What comes back for a domain that does not exist?
ok:true with an empty result and a per-source explanation, not an error. A made-up domain returned count 0, an empty subdomains array and an empty source_matrix, with sources showing certspotter ok:true count 0, otx ok:true count 0, and crtsh, hackertarget and wayback all ok:false with their own notes. An empty count with several sources reporting ok:true is a real negative; an empty count where every source reports ok:false means you learned nothing and should retry.
What is the Passive OSINT & Recon API?
Passive OSINT & Recon API is a ReefAPI endpoint group for passive osint & recon It returns live JSON through POST requests under /passive-osint/v1.
Is the Passive OSINT & Recon API free to try?
Yes. ReefAPI starts with 1,000 free credits, no card required. Passive OSINT & Recon calls use the same shared credit balance as every other ReefAPI engine.
Do I need a Passive OSINT & Recon login or account?
No login to Passive OSINT & Recon is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.
How fresh is the Passive OSINT & Recon data?
The page example is captured from a live subdomains call, and production requests fetch live data through ReefAPI rather than a static sample.
How many credits does the Passive OSINT & Recon API use?
Passive OSINT & Recon actions currently cost 1-3 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.
Can I call Passive OSINT & Recon from an AI assistant or MCP client?
Yes. Connect ReefAPI once through MCP and your assistant can call passive-osint actions with the same key, credit pool and JSON envelope used by normal REST requests.