Request demo

SOC Teams

External Signal for the Queue You Already Run.

Your SIEM, EDR and log pipeline cover what happens inside. The Deepinfo Platform adds what sits outside: exposed assets, leaked credentials and lookalike domains, each raised as a finding your analysts can work and close.

When an alert needs context, Deepinfo’s index answers through the API: who registered a domain and when, what else shares its IP, what it resolved to last month.

Talk to us
  1. EASM issue · newly_detected
  2. Leaked credential · newly_detected
  3. Compromised device · newly_detected
  4. Lookalike domain · newly_detectedopened

Live lookupsall returned

acme-login.example lookalike domain

  1. WHOIS/lookup/whois

    created 2026-09-14 · registrar …

  2. DNS/lookup/dns · A,MX

    ips 203.0.113.24

  3. Reverse IP/discovery/reverse-ip

    domains_on_first_ip 3 more lookalikes

Monitored across DNS, MX, SSL and HTTP

state approved

Your SIEM Sees Inside. Attackers Start Outside.

Internal telemetry covers the hosts you manage and the logs you collect. Some of the earliest signs of an intrusion sit where your sensors never look.

EASM

Assets Outside the Inventory

A forgotten subdomain with remote desktop open, a certificate about to expire, a CVE on a server nobody patches. None of it reaches your SIEM until someone uses it.

CTI

Credentials That Already Left

Infostealer logs and breach data carry your employees’ logins and session cookies. Often the earliest internal trace is a sign-in that looks legitimate.

BRP

Infrastructure Built to Imitate You

A lookalike domain with mail servers and a certificate is phishing infrastructure waiting for a campaign. Your mail gateway meets it only when a message arrives.

Findings That Arrive With a State.

External Attack Surface Management raises issues, Cyber Threat Intelligence raises leaked credentials, infected devices and breached addresses, and Brand Risk Protection raises lookalike domains. Issues, credentials and lookalikes are records with a state, not lines in a digest, so each decision stays on record.

FindingWhat arrives with itHow your team works it
EASM issueThe asset, the evidence from the scan layer that raised it and a severity from Critical to Information. CVEs carry CVSS, EPSS and CISA KEV.States from newly detected to verified resolved. A resolved issue that comes back reopens as reappeared.
Leaked credentialAn employee login or a customer login for your services, matched to your domains, or a payment card on your BINsResolved, risk accepted, ignored or false positive, one at a time or by filter. Revert restores the previous state.
Compromised deviceAn infostealer infection with hardware ID, user and system info, and password, cookie and autofill countsSearchable with the filter syntax all searches share
Lookalike domainA domain matched to your brand keywords by exact, fuzzy or confusable matchingApprove, ignore or revert. Approved domains are monitored across DNS, MX, SSL and HTTP, with a risk score timeline.
Breached addressA corporate email address found in a known breach, with the data types that leaked beside itA notification event of its own, and the CTI Email Breach Summary report

State changes and exports take the same filter body as search, so a playbook can close all findings that match a query in one request.

Get Context for Any Indicator Inside the Playbook.

Triage stalls on context: who registered a domain and when, what else resolves to the same IP, whether a certificate is self-signed. The lookup and discovery endpoints answer from the index, inside the playbook that raised the ticket.

History answers from the index too. DNS history lists every value a name has resolved to with each time it was seen, and WHOIS history lists each registration record a domain has had.

  • Domain WHOIS, DNS, IP WHOIS and SSL, queried live
  • DNS and WHOIS history
  • Reverse IP, MX, NS and WHOIS email
  • Domain Detail: WHOIS, DNS, IP history, SSL and web data in one record
Lookup reference
enrich.py 
import requests

API = "https://api.deepinfo.com/v1"
KEY = {"apikey": "YOUR_API_KEY"}

def get(path, **params):
    r = requests.get(API + path,
                     params=params, headers=KEY)
    r.raise_for_status()
    return r.json()

def enrich(domain):
    whois = get("/lookup/whois", domain=domain)
    dns = get("/lookup/dns", domain=domain,
              type="A,MX")
    ips = next(x["values"] for x in dns["responses"]
               if x["type"] == "A")
    rev = get("/discovery/reverse-ip", ip=ips[0])
    return {
        "created": whois["parsed"]["create_date"],
        "registrar": whois["parsed"]["registrar"],
        "ips": ips,
        "domains_on_first_ip": rev["result_count"],
    }

# A lookalike domain from an alert
print(enrich("acme-login.example"))

From Alert to Verified Fix.

  1. 01

    Alert

    A notification rule fires on an event, such as a new issue, a new open port or a new fraudulent domain. It arrives instantly or in an hourly to monthly digest.

  2. 02

    Enrich

    The analyst pulls WHOIS, DNS and certificate data for the indicator, then pivots on its IP or name server to see what sits beside it.

  3. 03

    Decide

    The finding moves to a state: resolved, risk accepted, ignored or false positive. A bulk action applies the same decision to all records that match a filter.

  4. 04

    Verify

    For an EASM issue, a rescan confirms the fix and the state becomes verified resolved. If the signal returns, the issue reopens as reappeared, a notification event of its own.

Hunt Across the Internet’s Record.

Your logs keep what your sensors saw, for as long as retention allows. The index keeps what the internet published: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates, with history.

Domain Search filters every domain on WHOIS, DNS, SSL and web data, so a hypothesis such as “lookalikes of our name, registered this year, with mail servers” is one query. From a single hit, the Same-Time Registered Domain Finder returns what the same registrant registered within minutes of it.

Threat Hunting use case
{
  "filters": {
    "must": [
      {
        "name": "domain.name",
        "type": "fuzzy",
        "value": "acme"
      },
      {
        "name": "domain.whois.create_date",
        "type": "gte",
        "value": "2026-01-01T00:00:00Z"
      },
      {
        "name": "dns.mx.mail_servers",
        "type": "exists",
        "value": true
      }
    ],
    "must_not": [
      {
        "name": "domain",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
  1. Lookalikes of our name
  2. Registered this year
  3. With mail servers
  4. Not our own domain

Move Findings to Where Analysts Work.

Export

Search, Then Export

Asset, issue, vulnerability, credential and lookalike searches each have an export twin. It takes the search’s filter body and returns all matching records as CSV or JSON, without paging.

Report

PDF Reports

Executive summary to issue detail, on demand or on a schedule, for the weekly review and the shift handover.

Connect

Integrations

What connects to the platform today, and the API patterns for everything else.

Integrations

The Data Is Yours to Use Too

The index under the platform is also sold as data. Teams that build their own tooling query it through the API or take it as bulk feeds, and Internet Insights shows what it sees each day.

Questions About SOC Teams

Does Deepinfo replace our SIEM or threat intelligence platform?

No. It adds the external layer those tools do not collect: your internet-facing assets, leaked credentials, lookalike domains and the index behind them. Findings and lookups reach your tools through the API and exports.

Which API calls help most during triage?

Domain WHOIS, DNS, IP WHOIS and SSL for the current state of an indicator, DNS and WHOIS history for its past, and reverse IP, MX, NS and WHOIS email for what sits beside it. Domain Detail returns everything on one domain in one record. See the Lookup and Discovery references.

Are lookups live or served from the index?

Both, depending on the endpoint. WHOIS, DNS, IP WHOIS and SSL lookups query the target or its registry at request time and stamp the answer with check_date, while history, finders and Domain Search read what the index has observed.

Can we look up indicators we don’t own?

Yes. Lookups, history and finders work for any domain, IP address or mail server an alert produces. Port Scan is the exception: it may only target hosts you own or are authorized to test.

Can a playbook close findings in bulk?

Yes. Issue, vulnerability and credential searches have bulk twins, such as mark resolved, accept risk, ignore, mark false positive and revert, that apply to every record matching a filter. An empty filter matches everything, so scope it before you run it.

Can we limit alerts to the assets that matter?

Yes. A notification rule can narrow its event by conditions such as asset, severity or tag, and it emails only the team members it names.

How do rate limits work?

Limits depend on your plan and apply per API key and per endpoint. Every response carries headers with the remaining allowance. See rate limits.

Will our sensors see Deepinfo’s scans?

They can. Scans run from infrastructure Deepinfo operates and make no attempt to hide from the hosts they check. Standard monitoring runs no authenticated scans, no exploit attempts and no load tests.

See the External Layer on Your Domain.

Book a working session on how findings and lookups fit your triage.

Request demo