Domains registered at the same moment.

Pass a seed domain. Get back domains registered within a configurable window around the seed's registration. Useful for catching campaign infrastructure registered together.

Talk to us Browse API docs

WHAT THIS API RETURNS

Co-registration as a discovery signal.

The Same Time Registered Domain Finder API surfaces domains registered close in time to a seed. Time-clustered registration is a common adversary signal: campaign infrastructure registered in a single batch, brand-impersonation runs registered together, or a coordinated drop across a registrar account.

Pass the seed domain and the interval parameter to define the window in minutes around the seed's registration timestamp. Default is a tight window; widen it when the campaign is suspected to span hours.

This is the API the IR and brand-protection teams reach for when one suspicious registration surfaces and they need the rest of the batch.

REQUEST

One endpoint, one required parameter.

Endpoint:

GET https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain={domain}

Parameters:

Name	In	Type	Required	Description
domain	query	string	Yes	Seed domain whose registration timestamp anchors the window.
interval	query	integer	No	Window size in minutes around the seed's registration timestamp. Default is a per-endpoint tight value; see docs.
include_subdomains	query	boolean	No	When true, surface FQDNs in addition to apex domains.
page	query	integer	No	Page number for paginated responses. Defaults to 1.
page_size	query	integer	No	Page size for paginated responses. Defaults to a sensible per-endpoint limit; see docs.
ordering	query	string	No	Field to sort by; prefix with `-` for descending order.
export	query	boolean	No	When true, returns the full result set as a downloadable export instead of paginated JSON.
export_format	query	enum	No	Format of the export when `export=true`. Typically `json` or `csv`.
export_scope	query	enum	No	Subset of fields to include in the export. See the docs for per-endpoint scopes.

Authentication is by API token in the request header. See docs.deepinfo.com for the full request reference.

SAMPLE RESPONSE

See what the API returns.

Real response structure for the Domains registered at the same moment endpoint. Field coverage may vary based on query parameters and data availability.

JSON RESPONSE

{
  "_request": {"domain": "acme-secure-login.com", "interval": 10},
  "seed": {"domain": "acme-secure-login.com", "create_date": "2026-04-30T14:23:08Z"},
  "results": [
    {"fqdn": "acme-account-verify.com", "create_date": "2026-04-30T14:23:11Z", "delta_seconds": 3},
    {"fqdn": "acme-login-portal.net",   "create_date": "2026-04-30T14:23:14Z", "delta_seconds": 6},
    {"fqdn": "acme-secure-portal.io",   "create_date": "2026-04-30T14:23:18Z", "delta_seconds": 10},
    {"fqdn": "acme-verify-account.com", "create_date": "2026-04-30T14:23:21Z", "delta_seconds": 13}
  ],
  "pagination": {"page": 1, "page_size": 50, "total": 18}
}

STRUCTURED VIEW

Request

Domain

acme-secure-login.com

Interval

Seed

Domain

acme-secure-login.com

Create date

2026-04-30T14:23:08Z

Results

Count

First fqdn

acme-account-verify.com

First create date

2026-04-30T14:23:11Z

First delta seconds

Pagination

Page

Page size

Total

Sample response shown. Real responses depend on query parameters, data availability, and API version. Talk to us for full schema documentation.

USE CASES

“Catching campaign infrastructure registered in clusters is the signal we tune our highest-priority alerts on. The configurable time window per request fits how attackers actually batch their registrations.”

— Lead Detection Engineer, Anti-Phishing Platform

CONTINUE EXPLORING

Other discovery APIs.

API

GET STARTED

Cluster a campaign batch, from any seed.

We'll set up token access and discuss interval tuning for your detection workflows.

Talk to us Browse API docs

Domains registered at the same moment.

Co-registration as a discovery signal.

One endpoint, one required parameter.

See what the API returns.

Workflows this API plugs into directly.

Phishing Detection and Prevention

Incident Investigation and Response

Brand Impersonation Protection

Other discovery APIs.

Search the global domain corpus, by any field.

Everything Deepinfo knows about one domain, in one call.

Every subdomain under any apex, in one call.

Every TLD permutation of a name, in one call.

Find every domain that looks like yours.

Find every domain registered to an email.

Cluster a campaign batch, from any seed.