Request demo

National CERTs

Exposure Visibility at the Scale of a Country.

A national CERT answers for institutions it does not operate: ministries, banks, operators, hospitals, universities. Its questions run across all of them at once, and often across every domain under the country code.

The Deepinfo Platform gives a CERT portfolios that scan and score each constituent on one scale, and the index underneath, queried through the API or delivered as bulk files.

Talk to us Browse the data feeds

Event

A CVE joins CISA KEV

  1. Ministries

    8 constituents

    1 to warn

  2. Banks

    8 constituents

    2 to warn

  3. Operators

    5 constituents

  4. Hospitals

    8 constituents

    1 to warn

  5. Universities

    7 constituents

    1 to warn

One scale, every constituent

5 to warn

The Jobs That Sit Above One Organization.

A national CERT coordinates. It watches across constituents, warns the ones at risk and gets hostile infrastructure taken down, all with data from outside any one network.

Watch

Sector Exposure

Follow the external posture of the institutions in each critical sector, and see which ones fall behind.

Warn

Constituent Alerts

When a CVE joins CISA KEV, see which monitored constituent assets carry it and warn those owners first.

Remove

Hostile Infrastructure

Lookalikes of ministries, banks and public services, with the DNS, certificate and HTTP evidence a registrar or host needs to act.

Research

Country-Wide Questions

Questions that span all domains under your country code, including ones no constituent registered.

Constituents Scored on One Shared Scale.

The platform keeps organizations other than your own as portfolios. Third-Party Risk Management uses them for vendors, groups use them for subsidiaries, and a CERT can hold one per constituent.

Each portfolio gets its own discovery, its own scans across all data layers and its own score, on a scale shared with the rest. A sector then reads as a set of comparable scores, not a stack of self-assessments.

Third-Party Risk Management
Scanning
All data layers, per asset, per constituent
Issue states
With the history of every change
Severity
From Critical to Information
Notifications
Including a drop in a domain’s score

Questions Only the Index Can Answer.

Some questions concern the whole country rather than a list of constituents. Deep Search & Insights filters every domain in the index on WHOIS, DNS, IP history, SSL and web data, and its finders pivot from one indicator to everything that shares it.

400M+ domains across every TLD
2B+ subdomains discovered and resolved
200B+ DNS records cumulative, with history
30B+ SSL certificates indexed

Which Domains Under Our Country Code Serve a Self-Signed or Invalid Certificate?

domain-search

Which Recently Registered Names Sit Close to a Ministry’s or a National Bank’s?

domain-search with fuzzy

How Many Domains Were Registered This Week, Which TLDs Led, and Which Name Keywords Recur?

registration-stats, tld-stats, keyword-stats

What Else Did the Registrant of a Phishing Domain Register Within the Same Hour?

sametime-domain-finder

Which Domains Share This Mail Server, Name Server or IP Address?

reverse-mx, reverse-ns, reverse-ip

Which CVEs Joined CISA KEV This Month, and How Do They Rank by EPSS?

vulnerability-search

Domain Search reference

Get the Domain Layer as Files.

Some analysis belongs inside your own environment, next to data only you hold. Deepinfo Data Feeds deliver the domain layer as files, CSV or JSON, each fetched through a pre-signed link that is valid for one hour.

The files: All Domains, All Subdomains, Daily Registered Domains, Daily Updated Domains, Daily Deleted Domains and Daily Discovered Subdomains.

All data feeds

List GET /feeds/latest

every file, its format, size, line count and update time

  1. all-domainsfull · every domain in the index

    csv

  2. all-subdomainsfull · every subdomain in the index

    json

  3. daily-registered-domainsdaily · registered in the last day

    csv

  4. daily-updated-domainsdaily · updated in the last day

    csv

  5. daily-deleted-domainsdaily · deleted in the last day

    csv

  6. daily-discovered-subdomainsdaily · discovered in the last day

    json

A line domain WHOIS · DNS

A pull list · request · download within the hour · check line_count

See Who Targets Your Country’s Sectors.

Cyber Threat Intelligence keeps a profile per threat actor: origin countries, the leak sites, forums and markets it appears in, and whom it targets, down to regions, countries, industries and organizations.

Aggregate views rank the most targeted countries and industries and the CVEs and tools actors use most. A sector warning can then start from actor behavior as well as from vulnerability data.

Threat Actor Intelligence
Profiles
Identity, origin, activity, targets
Capabilities
CVEs and tools used
Aggregates
Most targeted countries, industries
Search
Filters across profile fields

The Modules a CERT Draws On.

Deep Search & Insights

The index, queried directly: Domain Search, reverse lookups, WHOIS and DNS history, vulnerability search and live lookups.

DSI

Third-Party Risk Management

Portfolios for organizations other than yours, discovered, scanned across all data layers and scored on one scale.

TPRM

Brand Risk Protection

Keyword rules with exact, fuzzy and confusable matching for the names of public institutions, monitoring of each approved lookalike across DNS, MX, SSL and HTTP, and Managed Takedown.

BRP

Cyber Threat Intelligence

Threat actor profiles by targeted country and industry, and dark web search by email domain, IP address or CVE.

CTI

Questions About National CERTs

Can we cover the whole country beyond constituent domains?

Yes, through the index. Domain Search filters every domain Deepinfo knows about, including by extension, and the All Domains and All Subdomains feeds deliver the full lists as files. Portfolio monitoring is separate and covers the assets you add to it.

Is there a real-time feed of new registrations?

Not in the public API. New registrations arrive as a daily file, the Daily Registered Domains feed, which lists the domains registered in the last day as of its file_update_time.

Can analysts work with the data in their own tools?

Yes. Every search and finder exports JSON or CSV, the feeds arrive as files, and the platform API covers findings, notifications and reports under one apikey header.

Can analysts port-scan any host?

No. Port Scan only targets hosts you own or are authorized to test. For other hosts, the index holds what it has observed: the domain record with its WHOIS, DNS, IP history, SSL and web data, and DNS and WHOIS history.

Does Deepinfo file takedown requests?

Managed Takedown is part of Brand Risk Protection: Deepinfo’s team assembles the evidence from monitoring and files the request with the registrar or host. Teams with their own reporting channels can use that evidence, exported through the API.

How are scope and terms agreed?

Directly with each CERT, starting from the sectors, the number of constituents and the data you need inside your environment.

Start From Your Sector List.

The opening conversation is operational: which sectors, how many constituents, which data you need in-house. We’ll say plainly what fits.

Talk to us Browse the data feeds