Why We Index the Internet, and Where We Draw the Line.

The Deepinfo index covers 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates. It changes every day, as new registrations, updates, deletions and newly discovered subdomains land in it. Building and running infrastructure at that scale has taken years of engineering, and it is the foundation under everything the platform does.

Why Run Our Own Index

Many exposure management vendors don’t operate their own view of the internet. They license data from a small number of providers and add their own enrichment on top. That is a legitimate way to build a product, and it comes with trade-offs the vendor doesn’t control.

Running the index ourselves means we control its freshness, its coverage, and how quickly it can follow when a customer’s scope needs something it doesn’t see yet. It also means the data under External Attack Surface Management, Brand Risk Protection and the other modules is the same data customers can query through the API. An analyst who doubts a finding can check it against the source.

The cost is responsibility. When you collect the data yourself, you also decide how it is collected, what is collected and what is left alone.

Where the Data Comes From

The index is built from the open internet: passive DNS, certificate transparency logs, public WHOIS and IP WHOIS records, and crawling of publicly reachable web pages. Everything in it is something anyone could reach with a resolver or a browser. DNS and WHOIS are kept with their history, which is what makes a question like “what did this name resolve to last year” answerable.

The Lines We Draw

No Personal Data Sold

Dataset access doesn’t include personal data beyond what is already public in WHOIS records or in surface-web indexing. We don’t broker personal data. Where WHOIS data is hidden behind a privacy service or a registrar’s policy, it stays hidden in our dataset.

No Collection Behind Authentication

We don’t bypass paywalls, defeat anti-scraping measures or access content that requires an account. The internet index is built from the open internet, and nothing else.

Customer Data Stays Customer Data

The assets, findings and configuration tied to a customer account belong to that customer. We don’t surface them to other customers and we don’t sell them. A customer’s discovered subdomains are that customer’s inventory, and we don’t redistribute them.

No Buying of Stolen Data

Dark web data is separate from the internet index. Where it appears in our coverage, it comes through sourcing practices established across the threat intelligence industry, and we don’t pay for newly stolen data. We don’t act as a buyer of breach material either: the point of dark web visibility is to see criminal infrastructure without taking part in the economy around it.

Why We Write Them Down

Lines that stay implicit are how internet-data businesses drift into positions they would never have chosen on purpose. If we change any of these, we will document the change publicly, with the reasoning. These lines also sit on our methodology page, next to how the data is collected and scored.

Researchers and procurement teams who need a specific line verified can talk to us. We would rather answer the question than leave it open.