Reverse WHOIS Email API
From One Registrant Email to the Domains Registered With It.
The Reverse WHOIS Email API takes an email address from a WHOIS record, a phishing kit or an incident ticket and returns the domains in Deepinfo’s index registered with it, or, with apex, registered with any address on that email domain.
email hostmaster@acme.example
- exact match
- acme-events.examplecreated 2024-03-18 · A 198.51.100.7
- acme-rewards.example
apex=true· any address @acme.example- acme-careers.example
- acme-status.example
- acme-events.example
- acme-rewards.example
A redacted or privacy-service address cannot be matched.
Ask by Address and Get Domain Records Back.
The path is reverse-email; the reference calls the endpoint Reverse WHOIS Email. Results use the envelope shared by all Discovery finders.
| Parameter | Type | Description | |
|---|---|---|---|
email | string | Required | The registrant email address, for example hostmaster@acme.example. |
apex | boolean | Optional | Default false. Set true to match every address on the email’s domain, not only the exact address. |
include_ | boolean | Optional | Default false. Set true to return matching subdomains as well as registered domains. |
page | integer | Optional | Page number, from 1. |
page_ | integer | Optional | Results per page. See pagination. |
export | boolean | Optional | Return the result set as an export instead of a page. Default false. |
export_ | string | Optional | json or csv. |
export_ | string | Optional | How much of each record to include: basic, default or extended. |
Request
curl "https://api.deepinfo.com/v1/discovery/reverse-email?email=hostmaster@acme.example&page_size=25" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/discovery/reverse-email",
params={"email": "hostmaster@acme.example", "page_size": 25},
headers={"apikey": "YOUR_API_KEY"},
)
data = r.json()
print(data["result_count"])
for d in data["results"]:
print(d["punycode"])const q = new URLSearchParams({ email: 'hostmaster@acme.example', page_size: '25' })
const r = await fetch(
'https://api.deepinfo.com/v1/discovery/reverse-email?' + q,
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { result_count, results } = await r.json()
console.log(result_count, results.map((d) => d.punycode))Response
{
"page": 1,
"page_size": 25,
"result_count": 2,
"results": [
{
"punycode": "acme-events.example",
"unicode": "acme-events.example",
"is_idn": false,
"type": 1,
"domain": {
"whois": {
"create_date": "2024-03-18T10:02:44Z",
"registrar": "…",
"registrant": { "email": "hostmaster@acme.example", "…": "…" },
"…": "…"
},
"whois_normalized": {
"registrant": { "email_domain_apex": "acme.example", "…": "…" }
},
"…": "…"
},
"dns": { "a": { "ip_addresses": ["198.51.100.7"] }, "…": "…" },
"ssl": { "…": "…" },
"webdata": { "…": "…" }
},
{ "punycode": "acme-rewards.example", "…": "domain record" }
]
}A malformed parameter, such as a non-boolean apex, returns a 400 that names it. Plan-dependent rate limits apply, one request per second by default.
Match One Address or the Whole Domain.
Default
The Exact Address
Matches domains registered with one address. Use it on an attacker’s mailbox or a single registrant account, where precision matters more than reach.
apex=true
Any Address on the Domain
Matches any registrant address on the email’s domain, so legal@, it@ and hostmaster@ all count. Use it on an organization’s own mail domain. On a shared webmail domain it matches strangers.
Limits
What It Cannot See
The match needs the owner’s address in the record. Where a registry redacts it, or a privacy service puts its own address there, the domain cannot be found by the owner’s address. WHOIS History shows whether an earlier record published one.
From One Domain to Its Registrant’s Portfolio.
-
01
Read the record
Pull the registrant email from the suspicious domain with the Domain WHOIS API.
-
02
Pivot
Pass that address to Reverse WHOIS Email. Each domain registered with it comes back as a full domain record, paged.
-
03
Triage
Each record already carries DNS, certificate and web data, so you can see which domains resolve and answer on the web without another call.
-
04
Extend
Find the rest of each batch with the Same-Time Registered Domain Finder, or the domains on its name servers with Reverse NS.
Workflows This Pivot Plugs Into.
Incident Investigation
Go from a registrant email in incident telemetry to the other domains registered with it.
Threat Hunting
Cluster adversary infrastructure by the registrant identity behind it.
Attack Surface Management
Find the domains your organization registered under its own mail domain, including ones that never reached the inventory.
M&A Due Diligence
Check a target’s domain portfolio against the list in its data room.
See This Data at Work in the Deepinfo Platform
This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs.
Questions About Reverse WHOIS Email API
Can we find domains that used an address in the past?
Use Domain Search on domain.whois_, which keeps each registrant email seen in a domain’s WHOIS records over time.
How do we know how many domains match?
Read result_ on the first page. It counts all matching domains across pages, so one call tells you the size of the portfolio.
Can we sort the domains we get back?
Yes, with ordering. ordering=punycode lists them alphabetically, and a - prefix reverses the order.
How is the Reverse WHOIS Email API priced?
As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.
Can analysts run this pivot without writing code?
Yes. Deep Search & Insights runs Reverse WHOIS Email and the other pivots in the Deepinfo Platform. See Domain Search.
Pivot on an Address From Your Cases.
Bring a registrant email from a recent investigation. We set up access and walk through how teams wire this pivot into hunting and response.