Find every domain registered to an email.

Pass an email address. Get back every domain in the corpus whose Whois registrant email matches. Useful for ownership-trail analysis and infrastructure attribution.

Talk to us Browse API docs

WHAT THIS API RETURNS

One pivot from email to ownership graph.

The Reverse Whois Email API queries the indexed corpus for every domain registered to a given email address across the full Whois history Deepinfo has observed. Match is on the registrant email field, including historical snapshots where the email appeared at any point.

Use the apex flag to control whether matches are reported at the apex level or include subdomain associations. Use include_subdomains to expand to FQDNs.

This is one of the highest-signal pivots in the API set. An email surfaced in incident telemetry, a doxing thread, or a phishing artifact unlocks the full registration history attached to that email.

REQUEST

One endpoint, one required parameter.

Endpoint:

GET https://api.deepinfo.com/v1/discovery/reverse-email?email={email}

Parameters:

Name	In	Type	Required	Description
email	query	string	Yes	An email address such as `registrar-contact@example.com`.
apex	query	boolean	No	When true, deduplicate results to apex domains only.
include_subdomains	query	boolean	No	When true, surface FQDNs in addition to apex domains.
page	query	integer	No	Page number for paginated responses. Defaults to 1.
page_size	query	integer	No	Page size for paginated responses. Defaults to a sensible per-endpoint limit; see docs.
ordering	query	string	No	Field to sort by; prefix with `-` for descending order.
export	query	boolean	No	When true, returns the full result set as a downloadable export instead of paginated JSON.
export_format	query	enum	No	Format of the export when `export=true`. Typically `json` or `csv`.
export_scope	query	enum	No	Subset of fields to include in the export. See the docs for per-endpoint scopes.

Authentication is by API token in the request header. See docs.deepinfo.com for the full request reference.

SAMPLE RESPONSE

See what the API returns.

Real response structure for the Find every domain registered to an email endpoint. Field coverage may vary based on query parameters and data availability.

JSON RESPONSE

{
  "_request": {"email": "registrar-contact@example.com"},
  "results": [
    {"fqdn": "example.com", "first_observed": "2017-08-14"},
    {"fqdn": "example.net", "first_observed": "2018-02-22"},
    {"fqdn": "example-corp.io", "first_observed": "2019-11-03"},
    {"fqdn": "example-secure.com", "first_observed": "2022-04-08"}
  ],
  "pagination": {"page": 1, "page_size": 50, "total": 19}
}

STRUCTURED VIEW

Request

registrar-contact@example.com

Results

Count

First fqdn

example.com

First first observed

2017-08-14

Pagination

Page

Page size

Total

Sample response shown. Real responses depend on query parameters, data availability, and API version. Talk to us for full schema documentation.

USE CASES

“Reverse Whois by email address is the pivot we use most often during attribution work. Fast returns across the historical Whois corpus mean we trace ownership chains in minutes that used to take half a day.”

— Principal Investigator, Cyber Threat Intelligence Vendor

CONTINUE EXPLORING

Other discovery APIs.

API

GET STARTED

Run a reverse-email pivot, from any email.

We'll set up token access and walk through how teams plug this into IR and hunt workflows.

Talk to us Browse API docs

Find every domain registered to an email.

One pivot from email to ownership graph.

One endpoint, one required parameter.

See what the API returns.

Workflows this API plugs into directly.

Incident Investigation and Response

Threat Hunting

Brand Impersonation Protection

Other discovery APIs.

Search the global domain corpus, by any field.

Everything Deepinfo knows about one domain, in one call.

Every subdomain under any apex, in one call.

Every TLD permutation of a name, in one call.

Find every domain that looks like yours.

Domains registered at the same moment.

Run a reverse-email pivot, from any email.