# Associated Domain Finder API URL: https://www.deepinfo.com/data-api/apis/associated-domain-finder/ ## From One Domain to the Portfolio Behind It. The Associated Domain Finder API takes a seed domain and finds the other domains that share its registrant email, organization or phone, its name servers, IP or mail servers, or the organization on its certificate. Choose the signals with `association`. Set `strict=true` when all chosen signals have to match. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Associated Domain Finder reference](https://docs.deepinfo.com/reference/discovery/associated-domain-finder/) ### Pick a Seed and the Signals to Match On. The response echoes the signals that were requested and the ones that could be applied to this seed. A seed behind WHOIS privacy has no registrant email to match on, which the second list makes visible. GET `https://api.deepinfo.com/v1/discovery/associated-domain-finder` [Reference](https://docs.deepinfo.com/reference/discovery/associated-domain-finder/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `domain` | string | Required | The seed, a registered domain such as `acme.example`. | | `association` | string | Optional | The signal or signals to match on: registrant email, organization or phone, name servers, IP, mail servers or SSL organization. | | `strict` | boolean | Optional | Require every requested signal to match. Default `false`. | | `include_subdomains` | boolean | Optional | Include matching subdomains as well. Default `false`. | | `page` | integer | Optional | Page number, from 1. | | `page_size` | integer | Optional | Results per page. | | `ordering` | string | Optional | Field to sort by. Prefix `-` for descending. | | `export` | boolean | Optional | Return the result as an export instead of a page. Default `false`. | | `export_format` | string | Optional | `json` or `csv`. | | `export_scope` | string | Optional | How much of each record to include: `basic`, `default` or `extended`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/discovery/associated-domain-finder?domain=acme.example&page_size=25" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/discovery/associated-domain-finder", params={"domain": "acme.example", "page_size": 25}, headers={"apikey": "YOUR_API_KEY"}, ) data = r.json() print("applied:", data["applied_association_parameters"]) for d in data["results"]: print(d["punycode"]) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/discovery/associated-domain-finder?domain=acme.example&page_size=25', { headers: { apikey: 'YOUR_API_KEY' } } ) const data = await r.json() console.log(data.applied_association_parameters, data.results.map((d) => d.punycode)) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 3, "results": [ { "punycode": "acme-group.example", "unicode": "acme-group.example", "is_idn": false, "domain": { "whois": { "create_date": "2014-02-11T09:15:11Z", "registrar": "…", "registrant": { "organization": "…", "email": "…" } } } }, { "punycode": "acme-labs.example", "unicode": "acme-labs.example", "is_idn": false }, { "punycode": "acme-retail.example", "unicode": "acme-retail.example", "is_idn": false } ], "domain": "acme.example", "requested_association_parameters": [ "whois_registrant_email", "whois_registrant_email_apex_normalized" ], "applied_association_parameters": [ "whois_registrant_email", "whois_registrant_email_apex_normalized" ] } ``` ### Shared Signals Run From the Owner to the Certificate. Each signal has a single-purpose endpoint or a Domain Search field of its own. This finder runs several of them from one seed, in one call. | Signal | Matches domains that share | On its own | | --- | --- | --- | | Registrant email | WHOIS registrant email address | [Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) | | Registrant organization | WHOIS registrant organization | Domain Search on `domain.whois.registrant.organization` | | Registrant phone | WHOIS registrant phone number | Domain Search on `domain.whois.registrant.phone` | | Name servers | Name servers | [Reverse NS](https://www.deepinfo.com/data-api/apis/reverse-ns/) | | IP address | Address in their A records | [Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/) | | Mail servers | MX hosts | [Reverse MX](https://www.deepinfo.com/data-api/apis/reverse-mx/) | | SSL organization | Organization named on their certificate | Domain Search on `ssl.subject.organization` | ### From One Seed to a Reviewed List. 1. **Seed** Start from a domain you know belongs to the organization, or from the suspicious one in front of you. 2. **Choose signals** Ownership signals for a portfolio. Infrastructure signals when the seed hides behind WHOIS privacy. `strict` when a shared provider makes one signal too broad. 3. **Review** Each result is a full domain record. Check registrar, dates, DNS and certificate before a domain goes on a list. 4. **Pivot again** Run the next hop from the domains you keep, or add them to EASM as seeds for continuous discovery. ### Where a Portfolio View Changes the Answer. #### [M&A Due Diligence](https://www.deepinfo.com/solutions/use-cases/mergers-acquisitions-due-diligence/) Start from the target’s main domain and list what else its registrant and infrastructure hold, beyond what the data room names. #### [Subsidiary Oversight](https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/) Find group-company domains registered by one team or served from shared mail and DNS servers. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) From one confirmed malicious domain, list the others that share its registrant details or hosting. #### [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/) Feed domains your inventory missed back into discovery, with the signal that tied each one to you. ### Single-Signal Pivots Take One Call Each. - [Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) (Discovery): Domains registered with one email address, or one email domain. - [Same-Time Registered Domains](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/) (Discovery): Domains a seed’s registrant registered within minutes of it. - [Reverse NS](https://www.deepinfo.com/data-api/apis/reverse-ns/) (Discovery): Domains that use a given name server. ### See This Data at Work in the Deepinfo Platform This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM) - [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) (TPRM) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) ### Questions About Associated Domain Finder API **Does it find look-alike domains?** No. Associations are shared attributes, not similar names. For typos and swapped letters, use `fuzzy` in [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/); [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) runs exact, fuzzy and confusable-character matching against your brands continuously. **What if the seed uses WHOIS privacy?** Registrant signals then have nothing to match, and `applied_association_parameters` comes back without them. Choose name servers, IP, mail servers or SSL organization instead. **Why is a result list sometimes very large?** Large DNS, hosting and mail providers are shared by many unrelated domains, so on their own those signals say little about ownership. Combine one with a registrant signal and set `strict=true`. **How is the Associated Domain Finder priced?** As part of an API services plan, priced by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Can analysts run this pivot without writing code?** Yes. Deep Search & Insights runs Associated Domains and the other pivots in the Deepinfo Platform. See [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/). ### Map the Portfolio Behind a Domain. Bring a seed your team is working on, one of yours or a suspicious one. We set up access and run the pivots with you on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)