Websites using NTLM - 2K Live sites

Name: Websites that use NTLM
Creator: webatla
License: https://webatla.com/terms

About NTLM Database preview Download

About NTLM

webatla tracks 1,769 live websites using NTLM, 0.0% of every site we index. Download the full list of websites that use NTLM as a daily JSONL export. Every record includes the domain plus DNS, WHOIS, IP address, hosting country and global rank.

NTLM (NT LAN Manager) is a Microsoft authentication protocol suite used to authenticate users in Windows-based network environments. It provides challenge-response authentication and is commonly used in enterprise intranets, SharePoint deployments, IIS web servers, and legacy Windows applications that require single sign-on within Active Directory environments without Kerberos.

Although largely superseded by Kerberos in modern Active Directory configurations, NTLM remains prevalent due to its support for authentication scenarios where Kerberos cannot be used, such as when clients access servers by IP address rather than hostname, or in workgroup environments. Security professionals often flag NTLM as a concern due to known vulnerabilities including pass-the-hash attacks, and Microsoft has been gradually moving to deprecate the protocol in favor of more secure alternatives.

At a glance

VendorMicrosoft

Websitedocs.microsoft.com ↗

LicenseProprietary

First release1993-01-01

All figures as of Aug 17, 2026

1,769 Sites detected

0.0% Of all websites

Database preview of NTLM sites

NTLM detection is a value inside the Technologies column. Two datasets carry it, switch between them to compare what's included.

webatla-technologies-ntlm-2026-08-17.jsonl.zst · 1,769 rows · 14 columns Daily fresh export

Domain	TLD suffix	TLD	Domain type	HTTP status	IP address	Country by IP	Social networks	Technologies last data checked	Technologies	PR value	Harmonic value	Domain creation date	Domain expiration date
gopoll.kr	kr	kr	ICANN	HTTP 401	211.180.148.56	KR	—	2026-08-04	NTLM, Basic, SPNEGO	0.0000138458	12,130,434	2016-05-27	2027-05-27
wemontage.com	com	com	ICANN	HTTP 401	18.191.105.71	US	—	2026-07-16	NTLM, GoDaddy, Microsoft 365, Microsoft HTTPAPI 2.0, Google Site Verification	0.000000248883	14,049,260	2011-08-06	2027-08-06
kxlims.com	com	com	ICANN	HTTP 401	182.140.144.226	CN	—	2026-08-08	IIS 10.0, NTLM, Digest, SPNEGO, Windows Server	0.000000128236	12,544,581	2017-02-14	2027-02-14
csa-inc.net	net	net	ICANN	HTTP 401	52.0.41.56	US	—	2026-07-28	IIS 10.0, HSTS, NTLM, HTTP/2, SPNEGO, Sectigo, Windows Server, Microsoft ASP.NET, Amazon Web Services	0.0000000633568	12,156,837	1999-03-26	2027-03-26
mprt.gov.bn	gov.bn	bn	ICANN	HTTP 401	103.4.188.110	BN	—	2026-08-12	IIS 10.0, NTLM, Windows Server, Microsoft ASP.NET, Microsoft SharePoint 16.0.0.5561	0.000000036341	14,084,275	2015-10-26	2027-10-26
…	…	…	…	…	…	…	…	…	…	…	…	…	…

Domain	TLD suffix	TLD	Domain type	HTTP status	IP address	Country by IP	Social networks	Technologies last data checked	Technologies	DNS last data checked	DNS Status	DNS records	PR value	Harmonic value	RDAP/WHOIS last data checked	RDAP/WHOIS method	Domain creation date	Domain expiration date	Domain last changed	Registrar	RDAP/WHOIS Record	Response Status RDAP/WHOIS
gopoll.kr	kr	kr	ICANN	HTTP 401	211.180.148.56	KR	—	2026-08-04	NTLM, Basic, SPNEGO	2026-08-08	TRUE	{"A":["211.180.148.56"],"NS":["ns.gabia.co.kr","ns.gabia.net","ns1.gabia.co.kr"],"SOA":{"mname":"ns.gabia.co.kr","retry":600,"rname":"hosting.gabia.com","expire":1209600,"serial":2021040718,"minimum":86400,"refresh":1800},"TXT":["v=spf1 ip4:211.180.148.56 ip4:121.254.162.233 ~all"]}	0.0000138458	12,130,434	2026-05-18	WHOIS	2016-05-27	2027-05-27	2026-04-21	Gabia, Inc.(http://www.gabia.co.kr)	{"raw_response":"query : gopoll.kr\n\n\n# KOREAN(UTF8)\n\n도메인이름 : gopoll.kr\n등록인 : (주)현대리서치\n등록인 주소 : 서울특별시 서초구 강남대로 156-1 2,3층 현대리서치\n등록인 우편번호 : 06744\n책임자 : (주)현대리서치\n책임자 전자우편 : ysko1@metrix.co.kr\n책임자 전화번호 : +82.263770754\n등록일 : 2016. 05. 27.\n최근 정보 변경일 : 2026. 04. 21.\n사용 종료일 : 2027. 05. 27.\n정보공개여부 : Y\n등록대행자 : (주)가비아(http://www.gabia.co.kr)\nDNSSEC : 미서명\n\n1차 네임서버 정보\n 호스트이름 : ns.gabia.co.kr\n IP 주소 : 43.201.170.100\n\n2차 네임서버 정보\n 호스트이름 : ns1.gabia.co.kr\n IP 주소 : 20.200.205.248\n 호스트이름 : ns.gabia.net\n\n네임서버 이름이 .kr이 아닌 경우는 IP주소가 보이지 않습니다.\n\n\n# ENGLISH\n\nDomain Name : gopoll.kr\nRegistrant : HYUNDAE RESEARCH\nRegistrant Address : 156-1 Gangnam-daero, Seocho-gu, Seoul, \nRegistrant Zip Code : 06744\nAdministrative Contact(AC) : HYUNDAE RESEARCH\nAC E-Mail : ysko1@metrix.co.kr\nAC Phone Number : +82.263770754\nRegistered Date : 2016. 05. 27.\nLast Updated Date : 2026. 04. 21.\nExpiration Date : 2027. 05. 27.\nPublishes : Y\nAuthorized Agency : Gabia, Inc.(http://www.gabia.co.kr)\nDNSSEC : unsigned\n\nPrimary Name Server\n Host Name : ns.gabia.co.kr\n IP Address : 43.201.170.100\n\nSecondary Name Server\n Host Name : ns1.gabia.co.kr\n IP Address : 20.200.205.248\n Host Name : ns.gabia.net\n\n\n- KISA/KRNIC WHOIS Service -"}	Domain is active
wemontage.com	com	com	ICANN	HTTP 401	18.191.105.71	US	—	2026-07-16	NTLM, GoDaddy, Microsoft 365, Microsoft HTTPAPI 2.0, Google Site Verification	2026-08-09	TRUE	{"A":["18.191.105.71"],"MX":[{"host":"wemontage-com.mail.protection.outlook.com","priority":0}],"NS":["ns33.domaincontrol.com","ns34.domaincontrol.com"],"SOA":{"mname":"NS33.DOMAINCONTROL.com","retry":7200,"rname":"dns.jomax.net","expire":604800,"serial":2024010101,"minimum":3600,"refresh":28800},"TXT":["NETORGFT8360554.onmicrosoft.com","_acme-challenge.wemontage.com=SCa56nQK7iiicC1OW1QdAYl7nQBnA4kgabs8f40_Q9o","_acme-challenge.wemontage.com=ck_qE2TOIvRw3nRKr_NXSsoN-CI0BCdnGr0YbKYyvzk","google-site-verification=E2NwXsvrRqxp3jLNTB1QOAnYjww1Y9dxVw1y7QznVn8","google-site-verification=T5BV22mABcUuM6vvNIJmd4xfr71I1CX1cK39ds6tauo","v=spf1 include:secureserver.net -all"]}	0.000000248883	14,049,260	2026-08-16	RDAP	2011-08-06	2027-08-06	2026-08-06	GoDaddy.com, LLC	{"raw_response":{"links":[{"rel":"self","href":"https://rdap.verisign.com/com/v1/domain/wemontage.com","type":"application/rdap+json","value":"https://rdap.verisign.com/com/v1/domain/wemontage.com"},{"rel":"related","href":"https://rdap.godaddy.com/v1/domain/WEMONTAGE.COM","type":"application/rdap+json","value":"https://rdap.verisign.com/com/v1/domain/wemontage.com"}],"events":[{"eventDate":"2011-08-06T04:39:43Z","eventAction":"registration"},{"eventDate":"2027-08-06T04:39:43Z","eventAction":"expiration"},{"eventDate":"2026-08-06T17:19:01Z","eventAction":"last changed"},{"eventDate":"2026-08-16T06:22:02Z","eventAction":"last update of RDAP database"}],"handle":"1670687695_DOMAIN_COM-VRSN","status":["client delete prohibited","client renew prohibited","client transfer prohibited","client update prohibited"],"ldhName":"WEMONTAGE.COM","notices":[{"links":[{"rel":"terms-of-service","href":"https://www.verisign.com/domain-names/registration-data-access-protocol/terms-service/index.xhtml","type":"text/html","value":"https://rdap.verisign.com/com/v1/domain/wemontage.com"}],"title":"Terms of Service","description":["Service subject to Terms of Use."]},{"links":[{"rel":"glossary","href":"https://icann.org/epp","type":"text/html","value":"https://rdap.verisign.com/com/v1/domain/wemontage.com"}],"title":"Status Codes","description":["For more information on domain status codes, please visit https://icann.org/epp"]},{"links":[{"rel":"help","href":"https://icann.org/wicf","type":"text/html","value":"https://rdap.verisign.com/com/v1/domain/wemontage.com"}],"title":"RDDS Inaccuracy Complaint Form","description":["URL of the ICANN RDDS Inaccuracy Complaint Form: https://icann.org/wicf"]}],"entities":[{"links":[{"rel":"about","href":"http://www.godaddy.com","type":"text/html","value":"https://rdap.godaddy.com/v1/"}],"roles":["registrar"],"handle":"146","entities":[{"roles":["abuse"],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text",""],["tel",{"type":"voice"},"uri","tel:480-624-2505"],["email",{},"text","abuse@godaddy.com"]]],"objectClassName":"entity"}],"publicIds":[{"type":"IANA Registrar ID","identifier":"146"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","GoDaddy.com, LLC"]]],"objectClassName":"entity"}],"secureDNS":{"delegationSigned":false},"nameservers":[{"ldhName":"NS33.DOMAINCONTROL.COM","objectClassName":"nameserver"},{"ldhName":"NS34.DOMAINCONTROL.COM","objectClassName":"nameserver"}],"objectClassName":"domain","rdapConformance":["rdap_level_0","icann_rdap_technical_implementation_guide_1","icann_rdap_response_profile_1"]}}	Domain is active
kxlims.com	com	com	ICANN	HTTP 401	182.140.144.226	CN	—	2026-08-08	IIS 10.0, NTLM, Digest, SPNEGO, Windows Server	2026-08-07	TRUE	{"A":["182.140.144.226"],"NS":["f1g1ns1.dnspod.net","f1g1ns2.dnspod.net"],"SOA":{"mname":"f1g1ns1.dnspod.net","retry":180,"rname":"freednsadmin.dnspod.com","expire":1209600,"serial":1783080834,"minimum":180,"refresh":3600}}	0.000000128236	12,544,581	2026-02-01	RDAP	2017-02-14	2027-02-14	2026-02-01	DNSPod, Inc.	{"raw_response":{"links":[{"rel":"self","href":"https://rdap.verisign.com/com/v1/domain/KXLIMS.COM","type":"application/rdap+json","value":"https://rdap.verisign.com/com/v1/domain/KXLIMS.COM"},{"rel":"related","href":"https://rdap.dnspod.cn/domain/KXLIMS.COM","type":"application/rdap+json","value":"https://rdap.dnspod.cn/domain/KXLIMS.COM"}],"events":[{"eventDate":"2017-02-14T07:07:15Z","eventAction":"registration"},{"eventDate":"2027-02-14T07:07:15Z","eventAction":"expiration"},{"eventDate":"2026-01-30T16:21:20Z","eventAction":"last changed"},{"eventDate":"2026-02-01T15:22:43Z","eventAction":"last update of RDAP database"}],"handle":"2097595532_DOMAIN_COM-VRSN","status":["active"],"ldhName":"KXLIMS.COM","notices":[{"links":[{"rel":"terms-of-service","href":"https://www.verisign.com/domain-names/registration-data-access-protocol/terms-service/index.xhtml","type":"text/html","value":"https://rdap.verisign.com/com/v1/domain/kxlims.com"}],"title":"Terms of Service","description":["Service subject to Terms of Use."]},{"links":[{"href":"https://icann.org/epp","type":"text/html"}],"title":"Status Codes","description":["For more information on domain status codes, please visit https://icann.org/epp"]},{"links":[{"rel":"help","href":"https://icann.org/wicf","type":"text/html","value":"https://rdap.verisign.com/com/v1/domain/kxlims.com"}],"title":"RDDS Inaccuracy Complaint Form","description":["URL of the ICANN RDDS Inaccuracy Complaint Form: https://icann.org/wicf"]}],"entities":[{"links":[{"rel":"about","href":"http://www.dnspod.cn","type":"text/html","value":"https://rdap.dnspod.cn/"}],"roles":["registrar"],"handle":"1697","entities":[{"roles":["abuse"],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text",""],["tel",{"type":"voice"},"uri","tel:+86.4009100100"],["email",{},"text","dnsabuse@tencent.com"]]],"objectClassName":"entity"}],"publicIds":[{"type":"IANA Registrar ID","identifier":"1697"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","DNSPod, Inc."]]],"objectClassName":"entity"}],"secureDNS":{"delegationSigned":false},"nameservers":[{"ldhName":"F1G1NS1.DNSPOD.NET","objectClassName":"nameserver"},{"ldhName":"F1G1NS2.DNSPOD.NET","objectClassName":"nameserver"}],"objectClassName":"domain","rdapConformance":["rdap_level_0","icann_rdap_technical_implementation_guide_1","icann_rdap_response_profile_1"]}}	Domain is active
csa-inc.net	net	net	ICANN	HTTP 401	52.0.41.56	US	—	2026-07-28	IIS 10.0, HSTS, NTLM, HTTP/2, SPNEGO, Sectigo, Windows Server, Microsoft ASP.NET, Amazon Web Services	2026-08-12	TRUE	{"A":["52.0.41.56"],"NS":["ns-1.awsdns-00.com","ns-1208.awsdns-23.org","ns-1813.awsdns-34.co.uk","ns-926.awsdns-51.net"],"CAA":[{"tag":"issue","flags":0,"value":"digicert.com"},{"tag":"issue","flags":0,"value":"sectigo.com"}],"SOA":{"mname":"ns-1813.awsdns-34.co.uk","retry":900,"rname":"awsdns-hostmaster.amazon.com","expire":1209600,"serial":1,"minimum":86400,"refresh":7200},"TXT":["_tg3f6en6yhd9h4qkf0b6xzv79rv9l89","v=spf1 ip4:24.97.227.177 include:spf_ips.tylertech.com include:mktomail.com ~all"]}	0.0000000633568	12,156,837	2026-03-11	RDAP	1999-03-26	2027-03-26	2026-03-11	Gandi SAS	{"raw_response":{"links":[{"rel":"self","href":"https://rdap.verisign.com/net/v1/domain/CSA-INC.NET","type":"application/rdap+json","value":"https://rdap.verisign.com/net/v1/domain/CSA-INC.NET"},{"rel":"related","href":"https://rdap.gandi.net/domain/CSA-INC.NET","type":"application/rdap+json","value":"https://rdap.gandi.net/domain/CSA-INC.NET"}],"events":[{"eventDate":"1999-03-26T05:00:00Z","eventAction":"registration"},{"eventDate":"2027-03-26T04:00:00Z","eventAction":"expiration"},{"eventDate":"2026-02-19T04:02:46Z","eventAction":"last changed"},{"eventDate":"2026-03-11T11:08:06Z","eventAction":"last update of RDAP database"}],"handle":"5168327_DOMAIN_NET-VRSN","status":["client transfer prohibited"],"ldhName":"CSA-INC.NET","notices":[{"links":[{"rel":"terms-of-service","href":"https://www.verisign.com/domain-names/registration-data-access-protocol/terms-service/index.xhtml","type":"text/html","value":"https://rdap.verisign.com/net/v1/domain/csa-inc.net"}],"title":"Terms of Service","description":["Service subject to Terms of Use."]},{"links":[{"href":"https://icann.org/epp","type":"text/html"}],"title":"Status Codes","description":["For more information on domain status codes, please visit https://icann.org/epp"]},{"links":[{"rel":"help","href":"https://icann.org/wicf","type":"text/html","value":"https://rdap.verisign.com/net/v1/domain/csa-inc.net"}],"title":"RDDS Inaccuracy Complaint Form","description":["URL of the ICANN RDDS Inaccuracy Complaint Form: https://icann.org/wicf"]}],"entities":[{"links":[{"rel":"about","href":"http://www.gandi.net","type":"text/html","value":"https://rdap.gandi.net/"}],"roles":["registrar"],"handle":"81","entities":[{"roles":["abuse"],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text",""],["tel",{"type":"voice"},"uri","tel:+33.170377661"],["email",{},"text","abuse@support.gandi.net"]]],"objectClassName":"entity"}],"publicIds":[{"type":"IANA Registrar ID","identifier":"81"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","Gandi SAS"]]],"objectClassName":"entity"}],"secureDNS":{"delegationSigned":false},"nameservers":[{"ldhName":"NS-1.AWSDNS-00.COM","objectClassName":"nameserver"},{"ldhName":"NS-1208.AWSDNS-23.ORG","objectClassName":"nameserver"},{"ldhName":"NS-1813.AWSDNS-34.CO.UK","objectClassName":"nameserver"},{"ldhName":"NS-926.AWSDNS-51.NET","objectClassName":"nameserver"}],"objectClassName":"domain","rdapConformance":["rdap_level_0","icann_rdap_technical_implementation_guide_1","icann_rdap_response_profile_1"]}}	Domain is active
mprt.gov.bn	gov.bn	bn	ICANN	HTTP 401	103.4.188.110	BN	—	2026-08-12	IIS 10.0, NTLM, Windows Server, Microsoft ASP.NET, Microsoft SharePoint 16.0.0.5561	2026-08-15	TRUE	{"A":["103.4.188.110"],"MX":[{"host":"smtp1.egc.gov.bn","priority":15},{"host":"smtp2.egc.gov.bn","priority":10}],"NS":["pt01.brunet.bn","pt02.brunet.bn"],"SOA":{"mname":"te02.brunet.bn","retry":3600,"rname":"dnsadmin.brunet.bn","expire":1209600,"serial":1445904282,"minimum":38400,"refresh":10800},"TXT":["MS=ms27721951","v=spf1 include:spf.egc.gov.bn ~all"]}	0.000000036341	14,084,275	2025-12-04	WHOIS	2015-10-26	2027-10-26	2015-10-26	NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE	{"raw_response":"\r\n---------------------------------------------------------------------- \r\n BNNIC WHOIS Server\r\n---------------------------------------------------------------------- \r\n\r\nThe following data is provided for information purposes only.\r\n\r\nRegistrar: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE\r\n\r\n Domain Name:\t\tMPRT.GOV.BN \r\n Creation Date:\t\t26-Oct-2015 16:51:04\r\n Modified Date:\t\t26-Oct-2015 16:51:04\r\n Expiration Date:\t\t26-Oct-2027 16:51:04\r\n Domain Status:\t\tok\r\n\r\n\r\n Registrant:\r\n\r\n Name: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE (BNC1416T)\r\n Email: network@egnc.gov.bn\r\n \r\n \r\n\r\n\r\n Administrative Contact:\r\n \r\n Name: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE (BNC1416T)\r\n Email: network@egnc.gov.bn\r\n \r\n \r\n\r\n\r\n Technical Contact:\r\n \r\n Name: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE (BNC1416T)\r\n Email: network@egnc.gov.bn\r\n \r\n \r\n\r\n\r\n Name Servers:\r\n PT01.BRUNET.BN (61.6.254.201)\r\n PT02.BRUNET.BN (61.6.254.202)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\n"}	Domain is active
…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…	…

Showing 5 of 1,769 rows · Technologies · Full website tech stack per site: CMS, payments, analytics, frameworks.

↓ Download preview (20 rows, free) Buy Technologies — €159 / month

Which websites are using NTLM?

webatla detects every site using NTLM and exports them as one downloadable list, so you can see who relies on this technology and what else runs alongside it.

Open the NTLM technology dataset to break adoption down by country and TLD, compare it with a competing technology, and track new domains over time.

Frequently asked questions

How many websites use NTLM?

webatla detects NTLM on 2K websites, refreshed daily, each with its domain, DNS, WHOIS, IP, country and ranking.

Can I download the list of websites using NTLM?

Yes, as structured JSONL. Grab a free sample first.

What's included for each site, and how fresh is it?

Domain, DNS, RDAP/WHOIS, the full technology stack, IP & country, PageRank and Harmonic, re-detected and re-exported daily.

How do I find the websites using NTLM?

Buy the technology dataset, then download the complete list of domains we detect using NTLM, re-exported every day.

What else is in the NTLM technology data?

Each row places NTLM next to the other technology on the same site, plus DNS, WHOIS, IP, country and ranking.

Can I download just the sites using NTLM, or the whole database?

Both. Every site running NTLM comes in the Technologies dataset, one downloadable file. Or buy All data for the entire database: technologies plus identity, ranking, DNS and RDAP/WHOIS for every domain, combined in one file. Daily fresh export.

How do I download the list of websites using NTLM?

Three steps: (1) grab the free 10,000-row sample to inspect the schema, (2) buy the Technologies dataset, (3) download the full list of every domain we detect running NTLM as a JSON Lines file. It is re-exported daily, so you can re-download the freshest list any time inside your access window. Each row carries the domain plus DNS, WHOIS, IP, hosting country and rank.