Nt
Download websites using NTLM
Authentication · by Microsoft · since 1993 · Proprietary
1K sites
-74.47% YoY
Latest export · 0 days ago
🔒 Get the list
Requires a dataset purchase
About NTLM
NTLM (NT LAN Manager) is a Microsoft authentication protocol suite used to authenticate users in Windows-based network environments. It provides challenge-response authentication and is commonly used in enterprise intranets, SharePoint deployments, IIS web servers, and legacy Windows applications that require single sign-on within Active Directory environments without Kerberos.
Although largely superseded by Kerberos in modern Active Directory configurations, NTLM remains prevalent due to its support for authentication scenarios where Kerberos cannot be used, such as when clients access servers by IP address rather than hostname, or in workgroup environments. Security professionals often flag NTLM as a concern due to known vulnerabilities including pass-the-hash attacks, and Microsoft has been gradually moving to deprecate the protocol in favor of more secure alternatives.
At a glance
CategoryAuthentication
VendorMicrosoft
LicenseProprietary
First release1993-01-01
1,008
Sites detected
0.0%
Of all websites
-74.5%
YoY change
Database preview of NTLM sites
NTLM detection is a value inside the Technologies column. Two datasets carry it — switch between them to compare what's included.
webatla-technologies-ntlm-2026-06-13.jsonl.zst · 1,008 rows · 1 B · 14 columns
Daily fresh export
| Domain | TLD suffix | TLD | Domain type | HTTP status | IP address | Country by IP | Social networks | Technologies last data checked | Technologies | PR value | Harmonic value | Domain creation date | Domain expiration date |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gopoll.kr | kr | kr | ICANN | HTTP 401 | 211.180.148.56 | KR | — | 2026-05-11 | NTLM, Basic, SPNEGO | 0.0000113502 | 11,992,193 | 2016-05-27 | 2027-05-27 |
| gazpromexpo.ru | ru | ru | ICANN | HTTP 401 | 31.186.63.178 | RU | — | 2026-05-10 | IIS 8.5, NTLM, Basic, SPNEGO, Windows Server, Outlook Web App 15.0.1497.48, Microsoft ASP.NET | 0.0000000288428 | 12,253,550 | 2008-09-30 | 2026-09-30 |
| deps.gov.bn | gov.bn | bn | ICANN | HTTP 401 | 103.4.188.110 | BN | — | 2026-05-05 | IIS 10.0, NTLM, Windows Server, Microsoft ASP.NET, Microsoft SharePoint 16.0.0.5548 | 0.0000000272678 | 13,965,193 | 2020-01-20 | 2026-01-20 |
| dgo.pt | pt | pt | ICANN | HTTP 401 | 213.141.4.254 | PT | — | 2026-05-05 | IIS 10.0, NTLM, Windows Server, Microsoft ASP.NET, Microsoft SharePoint 16.0.0.10363 | 0.0000000250748 | 13,652,381 | 1996-12-30 | 2026-11-02 |
| agmsecure.com | com | com | ICANN | HTTP 401 | 72.3.154.165 | US | — | 2026-04-24 | IIS 7.5, NTLM, SPNEGO, Windows Server, Microsoft ASP.NET | 0.0000000217191 | 7,083,659 | 2006-07-27 | 2026-07-27 |
| … | … | … | … | … | … | … | … | … | … | … | … | … | … |
| Domain | TLD suffix | TLD | Domain type | HTTP status | IP address | Country by IP | Social networks | Technologies last data checked | Technologies | DNS last data checked | DNS Status | DNS records | PR value | Harmonic value | RDAP/WHOIS last data checked | RDAP/WHOIS method | Domain creation date | Domain expiration date | Domain last changed | Registrar | RDAP/WHOIS Record | Response Status RDAP/WHOIS |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gopoll.kr | kr | kr | ICANN | HTTP 401 | 211.180.148.56 | KR | — | 2026-05-11 | NTLM, Basic, SPNEGO | 2026-06-07 | TRUE | {"A":["211.180.148.56"],"NS":["ns.gabia.co.kr","ns.gabia.net","ns1.gabia.co.kr"],"SOA":{"mname":"ns.gabia.co.kr","retry":600,"rname":"hosting.gabia.com","expire":1209600,"serial":2021040718,"minimum":86400,"refresh":1800},"TXT":["v=spf1 ip4:211.180.148.56 ip4:121.254.162.233 ~all"]} | 0.0000113502 | 11,992,193 | 2026-05-18 | WHOIS | 2016-05-27 | 2027-05-27 | 2026-04-21 | Gabia, Inc.(http://www.gabia.co.kr) | {"raw_response":"query : gopoll.kr\n\n\n# KOREAN(UTF8)\n\n도메인이름 : gopoll.kr\n등록인 : (주)현대리서치\n등록인 주소 : 서울특별시 서초구 강남대로 156-1 2,3층 현대리서치\n등록인 우편번호 : 06744\n책임자 : (주)현대리서치\n책임자 전자우편 : ysko1@metrix.co.kr\n책임자 전화번호 : +82.263770754\n등록일 : 2016. 05. 27.\n최근 정보 변경일 : 2026. 04. 21.\n사용 종료일 : 2027. 05. 27.\n정보공개여부 : Y\n등록대행자 : (주)가비아(http://www.gabia.co.kr)\nDNSSEC : 미서명\n\n1차 네임서버 정보\n 호스트이름 : ns.gabia.co.kr\n IP 주소 : 43.201.170.100\n\n2차 네임서버 정보\n 호스트이름 : ns1.gabia.co.kr\n IP 주소 : 20.200.205.248\n 호스트이름 : ns.gabia.net\n\n네임서버 이름이 .kr이 아닌 경우는 IP주소가 보이지 않습니다.\n\n\n# ENGLISH\n\nDomain Name : gopoll.kr\nRegistrant : HYUNDAE RESEARCH\nRegistrant Address : 156-1 Gangnam-daero, Seocho-gu, Seoul, \nRegistrant Zip Code : 06744\nAdministrative Contact(AC) : HYUNDAE RESEARCH\nAC E-Mail : ysko1@metrix.co.kr\nAC Phone Number : +82.263770754\nRegistered Date : 2016. 05. 27.\nLast Updated Date : 2026. 04. 21.\nExpiration Date : 2027. 05. 27.\nPublishes : Y\nAuthorized Agency : Gabia, Inc.(http://www.gabia.co.kr)\nDNSSEC : unsigned\n\nPrimary Name Server\n Host Name : ns.gabia.co.kr\n IP Address : 43.201.170.100\n\nSecondary Name Server\n Host Name : ns1.gabia.co.kr\n IP Address : 20.200.205.248\n Host Name : ns.gabia.net\n\n\n- KISA/KRNIC WHOIS Service -"} | Domain is active |
| gazpromexpo.ru | ru | ru | ICANN | HTTP 401 | 31.186.63.178 | RU | — | 2026-05-10 | IIS 8.5, NTLM, Basic, SPNEGO, Windows Server, Outlook Web App 15.0.1497.48, Microsoft ASP.NET | 2026-06-05 | TRUE | {"A":["31.186.63.178"],"MX":[{"host":"mx.gazpromexpo.ru","priority":10}],"NS":["ns.gazpromtelecom.ru","ns2.gazpromtelecom.ru","ns3.gazpromtelecom.ru"],"SOA":{"mname":"ns.gazpromtelecom.ru","retry":1800,"rname":"noc.gazpromtelecom.ru","expire":604800,"serial":2023103102,"minimum":86400,"refresh":3600},"TXT":["v=spf1 +a +mx -all"]} | 0.0000000288428 | 12,253,550 | 2025-10-03 | WHOIS | 2008-09-30 | 2026-09-30 | 2025-10-02 | RU-CENTER-RU | {"raw_response":"% TCI Whois Service. Terms of use:\n% https://tcinet.ru/documents/whois_ru_rf.pdf (in Russian)\n% https://tcinet.ru/documents/whois_su.pdf (in Russian)\n\ndomain: GAZPROMEXPO.RU\nnserver: ns2.gazpromtelecom.ru.\nnserver: ns3.gazpromtelecom.ru.\nnserver: ns.gazpromtelecom.ru.\nstate: REGISTERED, DELEGATED, VERIFIED\norg: OOO \"Gazprom ekspo\"\ntaxpayer-id: 7736045557\nregistrar: RU-CENTER-RU\nadmin-contact: https://www.nic.ru/whois\ncreated: 2008-09-30T20:00:00Z\npaid-till: 2026-09-30T21:00:00Z\nfree-date: 2026-11-01\nsource: TCI\n\nLast updated on 2025-10-02T22:53:01Z\n\n"} | Domain is active |
| deps.gov.bn | gov.bn | bn | ICANN | HTTP 401 | 103.4.188.110 | BN | — | 2026-05-05 | IIS 10.0, NTLM, Windows Server, Microsoft ASP.NET, Microsoft SharePoint 16.0.0.5548 | 2026-05-27 | TRUE | {"A":["103.4.188.110"],"NS":["pt01.brunet.bn","pt02.brunet.bn"],"SOA":{"mname":"te02.brunet.bn","retry":3600,"rname":"please_set_email.absolutely.nowhere","expire":2419200,"serial":9,"minimum":900,"refresh":10800}} | 0.0000000272678 | 13,965,193 | 2026-05-29 | WHOIS | 2020-01-20 | 2026-01-20 | 2026-01-20 | NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE | {"raw_response":"---------------------------------------------------------------------- \r\n BNNIC WHOIS Server\r\n---------------------------------------------------------------------- \r\n\r\nThe following data is provided for information purposes only.\r\n\r\nRegistrar: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE\r\n\r\n Domain Name:\t\tDEPS.GOV.BN \r\n Creation Date:\t\t20-Jan-2020 10:24:01\r\n Modified Date:\t\t20-Jan-2026 10:45:03\r\n Expiration Date:\t\t20-Jan-2026 10:24:01\r\n Domain Status:\t\tpendingRenew\r\n\r\n\r\n Registrant:\r\n\r\n Name: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE (BNC1416T)\r\n Email: network@egnc.gov.bn\r\n \r\n \r\n\r\n\r\n Administrative Contact:\r\n \r\n Name: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE (BNC1416T)\r\n Email: network@egnc.gov.bn\r\n \r\n \r\n\r\n\r\n Technical Contact:\r\n \r\n Name: NETWORK SECTION, E-GOVERNMENT NATIONAL CENTRE (BNC1416T)\r\n Email: network@egnc.gov.bn\r\n \r\n \r\n\r\n\r\n Name Servers:\r\n PT01.BRUNET.BN (61.6.254.201)\r\n PT02.BRUNET.BN (61.6.254.202)"} | Domain is active |
| dgo.pt | pt | pt | ICANN | HTTP 401 | 213.141.4.254 | PT | — | 2026-05-05 | IIS 10.0, NTLM, Windows Server, Microsoft ASP.NET, Microsoft SharePoint 16.0.0.10363 | 2026-05-27 | TRUE | {"A":["213.141.4.254"],"MX":[{"host":"mail.dgo.pt","priority":5},{"host":"smtp1.artelecom.pt","priority":20},{"host":"smtp2.artelecom.pt","priority":30}],"NS":["dnsh01.artelecom.pt","dnsh02.artelecom.pt","dnsh03.artelecom.pt"],"SOA":{"mname":"dnsh01.artelecom.pt","retry":1800,"rname":"suporte.artelecom.pt","expire":1209600,"serial":2025082100,"minimum":86400,"refresh":3600},"TXT":["mtc=MjRlNWQzZjktOWRiOC00ZmM5LWFiNzgtMzFhYmIzODgyZDA2","v=spf1 mx include:spf.protection.outlook.com -all"]} | 0.0000000250748 | 13,652,381 | 2026-03-16 | WHOIS | 1996-12-30 | 2026-11-02 | — | — | {"raw_response":"Domain: dgo.pt\nDomain Status: Registered\nCreation Date: 30/12/1996 00:00:00\nExpiration Date: 02/11/2026 23:59:00\nOwner Name: Direccao Geral do Orcamento\nOwner Address: Rua da Alfandega, 5 - 2o.\nOwner Locality: Lisboa\nOwner ZipCode: 1149-004\nOwner Locality ZipCode: Lisboa\nOwner Country Code: PT\nOwner Email: web.dsin@dgo.pt;,luis.paiva@dgo.pt;,;joao.caeiro@dgo.pt\nAdmin Name: Ar Telecom - Acessos e Redes de Telecomunicações S.A.\nAdmin Address: Edifício Diogo Cão - Doca de Alcântara - Norte\nAdmin Locality: Lisboa\nAdmin ZipCode: 1350-352\nAdmin Locality ZipCode: Lisboa\nAdmin Country Code: PT\nAdmin Email: gestao.dominios@artelecom.pt,Facturas.Fornecedores@artelecom.pt,suporte@artelecom.pt\nName Server: dnsh01.artelecom.pt | IPv4: 213.141.4.251 and IPv6: \nName Server: dnsh02.artelecom.pt | IPv4: 213.141.27.251 and IPv6: \nName Server: dnsh03.artelecom.pt | IPv4: 213.141.4.252 and IPv6: \n"} | Domain is active |
| agmsecure.com | com | com | ICANN | HTTP 401 | 72.3.154.165 | US | — | 2026-04-24 | IIS 7.5, NTLM, SPNEGO, Windows Server, Microsoft ASP.NET | 2026-06-09 | TRUE | {"A":["72.3.154.165"],"MX":[{"host":"mx1.emailsrvr.com","priority":10},{"host":"mx2.emailsrvr.com","priority":20}],"NS":["ns.rackspace.com","ns2.rackspace.com"],"SOA":{"mname":"ns.rackspace.com","retry":3600,"rname":"hostmaster.rackspace.com","expire":604800,"serial":1430806066,"minimum":300,"refresh":10800},"TXT":["v=spf1 a mx ptr ip4:74.205.83.130 include:emailsrvr.com ~all"]} | 0.0000000217191 | 7,083,659 | 2025-07-23 | RDAP | 2006-07-27 | 2026-07-27 | 2025-07-22 | GoDaddy.com, LLC | {"raw_response":{"links":[{"rel":"self","href":"https://rdap.verisign.com/com/v1/domain/AGMSECURE.COM","type":"application/rdap+json","value":"https://rdap.verisign.com/com/v1/domain/AGMSECURE.COM"},{"rel":"related","href":"https://rdap.godaddy.com/v1/domain/AGMSECURE.COM","type":"application/rdap+json","value":"https://rdap.godaddy.com/v1/domain/AGMSECURE.COM"}],"events":[{"eventDate":"2006-07-27T23:41:00Z","eventAction":"registration"},{"eventDate":"2026-07-27T23:41:00Z","eventAction":"expiration"},{"eventDate":"2025-07-20T04:48:40Z","eventAction":"last changed"},{"eventDate":"2025-07-22T23:28:15Z","eventAction":"last update of RDAP database"}],"handle":"534684987_DOMAIN_COM-VRSN","status":["client delete prohibited","client renew prohibited","client transfer prohibited","client update prohibited"],"ldhName":"AGMSECURE.COM","notices":[{"links":[{"rel":"terms-of-service","href":"https://www.verisign.com/domain-names/registration-data-access-protocol/terms-service/index.xhtml","type":"text/html","value":"https://rdap.verisign.com/com/v1/domain/agmsecure.com"}],"title":"Terms of Service","description":["Service subject to Terms of Use."]},{"links":[{"href":"https://icann.org/epp","type":"text/html"}],"title":"Status Codes","description":["For more information on domain status codes, please visit https://icann.org/epp"]},{"links":[{"rel":"help","href":"https://icann.org/wicf","type":"text/html","value":"https://rdap.verisign.com/com/v1/domain/agmsecure.com"}],"title":"RDDS Inaccuracy Complaint Form","description":["URL of the ICANN RDDS Inaccuracy Complaint Form: https://icann.org/wicf"]}],"entities":[{"links":[{"rel":"about","href":"http://www.godaddy.com","type":"text/html","value":"https://rdap.godaddy.com/v1/"}],"roles":["registrar"],"handle":"146","entities":[{"roles":["abuse"],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text",""],["tel",{"type":"voice"},"uri","tel:480-624-2505"],["email",{},"text","abuse@godaddy.com"]]],"objectClassName":"entity"}],"publicIds":[{"type":"IANA Registrar ID","identifier":"146"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","GoDaddy.com, LLC"]]],"objectClassName":"entity"}],"secureDNS":{"delegationSigned":false},"nameservers":[{"ldhName":"NS.RACKSPACE.COM","objectClassName":"nameserver"},{"ldhName":"NS2.RACKSPACE.COM","objectClassName":"nameserver"}],"objectClassName":"domain","rdapConformance":["rdap_level_0","icann_rdap_technical_implementation_guide_1","icann_rdap_response_profile_1"]}} | Domain is active |
| … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … | … |
Showing 5 of 1,008 rows · Technologies · Full website tech stack per site — CMS, payments, analytics, frameworks.
+ 4 datasets don't carry the Technologies column.
The NTLM dataset
Every site we've detected as running NTLM — with version, hosting, country, TLD and traffic rank.
NTLM lives inside 2 datasets
NTLM detection is part of Technologies (€159/mo) and All data (€599/mo). Buy either to filter the full 1,008-site list — or grab a free preview first.
Frequently asked questions
How many websites use NTLM?
webatla detects NTLM on 1K websites, refreshed daily — each with its domain, DNS, WHOIS, IP, country and ranking.
Can I download the list of websites using NTLM?
Yes — as structured JSONL. Pay once for one month, no subscription; grab a free sample first.
What's included for each site, and how fresh is it?
Domain, DNS, RDAP/WHOIS, the full technology stack, IP & country, PageRank and Harmonic — re-detected and re-exported daily.
Related technologies