# Reverse WHOIS Email API URL: https://www.deepinfo.com/data-api/apis/reverse-whois-email/ ## From One Registrant Email to the Domains Registered With It. The Reverse WHOIS Email API takes an email address from a WHOIS record, a phishing kit or an incident ticket and returns the domains in Deepinfo’s index registered with it, or, with `apex`, registered with any address on that email domain. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Reverse WHOIS Email reference](https://docs.deepinfo.com/reference/discovery/reverse-whois-email/) ### Ask by Address and Get Domain Records Back. The path is `reverse-email`; the reference calls the endpoint Reverse WHOIS Email. Results use the envelope shared by all Discovery finders. GET `https://api.deepinfo.com/v1/discovery/reverse-email` [Reference](https://docs.deepinfo.com/reference/discovery/reverse-whois-email/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `email` | string | Required | The registrant email address, for example `hostmaster@acme.example`. | | `apex` | boolean | Optional | Default `false`. Set `true` to match every address on the email’s domain, not only the exact address. | | `include_subdomains` | boolean | Optional | Default `false`. Set `true` to return matching subdomains as well as registered domains. | | `page` | integer | Optional | Page number, from 1. | | `page_size` | integer | Optional | Results per page. See [pagination](https://docs.deepinfo.com/getting-started/pagination/). | | `export` | boolean | Optional | Return the result set as an export instead of a page. Default `false`. | | `export_format` | string | Optional | `json` or `csv`. | | `export_scope` | string | Optional | How much of each record to include: `basic`, `default` or `extended`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/discovery/reverse-email?email=hostmaster@acme.example&page_size=25" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/discovery/reverse-email", params={"email": "hostmaster@acme.example", "page_size": 25}, headers={"apikey": "YOUR_API_KEY"}, ) data = r.json() print(data["result_count"]) for d in data["results"]: print(d["punycode"]) ``` JavaScript: ```javascript const q = new URLSearchParams({ email: 'hostmaster@acme.example', page_size: '25' }) const r = await fetch( 'https://api.deepinfo.com/v1/discovery/reverse-email?' + q, { headers: { apikey: 'YOUR_API_KEY' } } ) const { result_count, results } = await r.json() console.log(result_count, results.map((d) => d.punycode)) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 2, "results": [ { "punycode": "acme-events.example", "unicode": "acme-events.example", "is_idn": false, "type": 1, "domain": { "whois": { "create_date": "2024-03-18T10:02:44Z", "registrar": "…", "registrant": { "email": "hostmaster@acme.example", "…": "…" }, "…": "…" }, "whois_normalized": { "registrant": { "email_domain_apex": "acme.example", "…": "…" } }, "…": "…" }, "dns": { "a": { "ip_addresses": ["198.51.100.7"] }, "…": "…" }, "ssl": { "…": "…" }, "webdata": { "…": "…" } }, { "punycode": "acme-rewards.example", "…": "domain record" } ] } ``` A malformed parameter, such as a non-boolean `apex`, returns a 400 that names it. Plan-dependent [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/) apply, one request per second by default. ### Match One Address or the Whole Domain. Default #### The Exact Address Matches domains registered with one address. Use it on an attacker’s mailbox or a single registrant account, where precision matters more than reach. apex=true #### Any Address on the Domain Matches any registrant address on the email’s domain, so `legal@`, `it@` and `hostmaster@` all count. Use it on an organization’s own mail domain. On a shared webmail domain it matches strangers. Limits #### What It Cannot See The match needs the owner’s address in the record. Where a registry redacts it, or a privacy service puts its own address there, the domain cannot be found by the owner’s address. [WHOIS History](https://www.deepinfo.com/data-api/apis/whois-history/) shows whether an earlier record published one. ### From One Domain to Its Registrant’s Portfolio. 1. **Read the record** Pull the registrant email from the suspicious domain with the [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/). 2. **Pivot** Pass that address to Reverse WHOIS Email. Each domain registered with it comes back as a full domain record, paged. 3. **Triage** Each record already carries DNS, certificate and web data, so you can see which domains resolve and answer on the web without another call. 4. **Extend** Find the rest of each batch with the [Same-Time Registered Domain Finder](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/), or the domains on its name servers with [Reverse NS](https://www.deepinfo.com/data-api/apis/reverse-ns/). ### Workflows This Pivot Plugs Into. #### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) Go from a registrant email in incident telemetry to the other domains registered with it. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Cluster adversary infrastructure by the registrant identity behind it. #### [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/) Find the domains your organization registered under its own mail domain, including ones that never reached the inventory. #### [M&A Due Diligence](https://www.deepinfo.com/solutions/use-cases/mergers-acquisitions-due-diligence/) Check a target’s domain portfolio against the list in its data room. ### Follow the Ownership Trail. - [Associated Domain Finder](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) (Discovery): Domains that share a registrant, name servers, IP, mail servers or SSL organization. - [Same-Time Registered Domain Finder](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/) (Discovery): Domains a seed’s registrant registered within minutes of it. - [WHOIS History](https://www.deepinfo.com/data-api/apis/whois-history/): Each distinct registration record a domain has had. ### See This Data at Work in the Deepinfo Platform This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM) - [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) (TPRM) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) ### Questions About Reverse WHOIS Email API **Can we find domains that used an address in the past?** Use [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) on `domain.whois_registrant_email_historical`, which keeps each registrant email seen in a domain’s WHOIS records over time. **How do we know how many domains match?** Read `result_count` on the first page. It counts all matching domains across pages, so one call tells you the size of the portfolio. **Can we sort the domains we get back?** Yes, with `ordering`. `ordering=punycode` lists them alphabetically, and a `-` prefix reverses the order. **How is the Reverse WHOIS Email API priced?** As part of an API services plan, priced by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Can analysts run this pivot without writing code?** Yes. Deep Search & Insights runs Reverse WHOIS Email and the other pivots in the Deepinfo Platform. See [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/). ### Pivot on an Address From Your Cases. Bring a registrant email from a recent investigation. We set up access and walk through how teams wire this pivot into hunting and response. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)