Find every domain on a name server.

Pass a name server hostname. Get back every domain that uses it. Useful for hosting-provider mapping and infrastructure clustering.

Talk to us Browse API docs

WHAT THIS API RETURNS

One pivot from name server to its full footprint.

The Reverse NS API queries the indexed corpus for every domain that uses a given name server. Match is on either current or historical name-server records; use the response metadata to distinguish.

Pass the name server hostname (without trailing dot). Use apex to deduplicate to apex domains and include_subdomains to expand to FQDNs.

This API is the right pivot when an attribution question shifts from 'who owns this' to 'who shares this hosting infrastructure.' Adversaries reuse name servers across campaigns; legitimate hosting providers anchor large clusters by definition.

REQUEST

One endpoint, one required parameter.

Endpoint:

GET https://api.deepinfo.com/v1/discovery/reverse-ns?ns={ns}

Parameters:

Name	In	Type	Required	Description
ns	query	string	Yes	A name server hostname such as `ns1.example-host.com`.
apex	query	boolean	No	When true, deduplicate results to apex domains only.
include_subdomains	query	boolean	No	When true, surface FQDNs in addition to apex domains.
page	query	integer	No	Page number for paginated responses. Defaults to 1.
page_size	query	integer	No	Page size for paginated responses. Defaults to a sensible per-endpoint limit; see docs.
ordering	query	string	No	Field to sort by; prefix with `-` for descending order.
export	query	boolean	No	When true, returns the full result set as a downloadable export instead of paginated JSON.
export_format	query	enum	No	Format of the export when `export=true`. Typically `json` or `csv`.
export_scope	query	enum	No	Subset of fields to include in the export. See the docs for per-endpoint scopes.

Authentication is by API token in the request header. See docs.deepinfo.com for the full request reference.

SAMPLE RESPONSE

See what the API returns.

Real response structure for the Find every domain on a name server endpoint. Field coverage may vary based on query parameters and data availability.

JSON RESPONSE

{
  "_request": {"ns": "ns1.example-host.com"},
  "results": [
    {"fqdn": "campaign-a-launch.com", "ns_first_seen": "2025-08-12"},
    {"fqdn": "campaign-b-launch.com", "ns_first_seen": "2025-08-12"},
    {"fqdn": "phish-portal-secure.io", "ns_first_seen": "2026-01-04"},
    {"fqdn": "verify-account-now.net", "ns_first_seen": "2026-03-19"}
  ],
  "pagination": {"page": 1, "page_size": 50, "total": 1284}
}

STRUCTURED VIEW

Request

ns1.example-host.com

Results

Count

First fqdn

campaign-a-launch.com

First ns first seen

2025-08-12

Pagination

Page

Page size

Total

1284

Sample response shown. Real responses depend on query parameters, data availability, and API version. Talk to us for full schema documentation.

USE CASES

“Name-server clustering exposes hosting providers used by threat actors at scale. The reverse-NS shape returns clean enough for direct ingestion into our infrastructure-attribution graph.”

— Senior Engineer, Threat Intelligence Platform

CONTINUE EXPLORING

Other lookup APIs.

API

GET STARTED

Run a reverse-NS pivot, from any hostname.

We'll set up token access and walk through how teams plug this into hunt and IR workflows.

Talk to us Browse API docs

Find every domain on a name server.

One pivot from name server to its full footprint.

One endpoint, one required parameter.

See what the API returns.

Workflows this API plugs into directly.

Threat Hunting

Incident Investigation and Response

Brand Impersonation Protection

Other lookup APIs.

Current Whois state for any domain, in one call.

Current IP allocation state, in one call.

Current DNS state for an FQDN, in one call.

Current TLS state for a host, in one call.

Find every domain on an MX record.

Find every domain on an IP.

Capture a target page as the user sees it.

Detect the technology stack of a target, in one call.

Live web-page data for a target, in one call.

Scan a target's open ports, in one call.

Run a reverse-NS pivot, from any hostname.