# Same-Time Registered Domain Finder API URL: https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/ ## Find the Rest of a Batch Registered Minutes Apart. The Same-Time Registered Domain Finder API takes one domain and returns the domains the same registrant registered within minutes of it, in a window you can widen with `interval`. Campaign infrastructure is often bought in one sitting, so one domain that surfaces can lead you to the rest. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [API reference](https://docs.deepinfo.com/reference/discovery/same-time-registered-domain-finder/) ### A Seed Domain Anchors the Time Window. The seed’s registration anchors the window, and only domains from the seed’s registrant count. Results use the shared Discovery finder envelope. GET `https://api.deepinfo.com/v1/discovery/sametime-domain-finder` [Reference](https://docs.deepinfo.com/reference/discovery/same-time-registered-domain-finder/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `domain` | string | Required | The seed domain, for example `acme-login.example`. | | `interval` | integer | Optional | Window in minutes, from 1 to 60. Default `5`. Domains the same registrant registered within this many minutes of the seed match. | | `include_subdomains` | boolean | Optional | Default `false`. Set `true` to return matching subdomains as well as registered domains. | | `page` | integer | Optional | Page number, from 1. | | `page_size` | integer | Optional | Results per page. See [pagination](https://docs.deepinfo.com/getting-started/pagination/). | | `ordering` | string | Optional | Field to sort by. Prefix `-` for descending. | | `export` | boolean | Optional | Return the result set as an export instead of a page. Default `false`. | | `export_format` | string | Optional | `json` or `csv`. | | `export_scope` | string | Optional | How much of each record to include: `basic`, `default` or `extended`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain=acme-login.example&interval=15&page_size=25" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/discovery/sametime-domain-finder", params={"domain": "acme-login.example", "interval": 15, "page_size": 25}, headers={"apikey": "YOUR_API_KEY"}, ) for d in r.json()["results"]: whois = (d.get("domain") or {}).get("whois") or {} print(whois.get("create_date"), d["punycode"]) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain=acme-login.example&interval=15&page_size=25', { headers: { apikey: 'YOUR_API_KEY' } } ) const { result_count, results } = await r.json() console.log(result_count, results.map((d) => d.punycode)) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 3, "results": [ { "punycode": "acme-verify.example", "unicode": "acme-verify.example", "is_idn": false, "type": 1, "domain": { "whois": { "create_date": "2026-09-14T08:13:02Z", "registrar": "…", "registrant": { "…": "…" }, "…": "…" }, "…": "…" }, "dns": { "a": { "ip_addresses": ["192.0.2.41"] }, "…": "…" }, "ssl": { "…": "…" }, "webdata": { "…": "…" } }, { "punycode": "acme-secure-pay.example", "…": "domain record" }, { "punycode": "acme-account-help.example", "…": "domain record" } ] } ``` An `interval` outside 1 to 60, like any invalid parameter, returns a 400 that names it. See [errors](https://docs.deepinfo.com/getting-started/errors/). Plan-dependent [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/) apply, one request per second by default. ### Batches Share a Registrant and a Few Minutes. A phishing operation often runs on several domains: a login page, a verification step, a spare for when the first one is taken down. They are often registered in one session, from one account. Timestamps alone would match strangers who bought a domain that minute. Requiring a shared registrant is what turns a coincidence into a cluster. In this batch, the seed and its siblings fall inside a 15-minute window. ### Start Tight and Widen With Care. 1 to 5 minutes #### Tight The default is 5 minutes. A tight window keeps a busy registrant’s unrelated purchases out of the result. 15 to 60 minutes #### Wide For batches registered over a longer session. Expect more results from busy registrant accounts, and check them against DNS and hosting before you act. In each result #### Evidence Attached Each match is a full domain record with WHOIS, DNS, certificate and web data, so you can see which siblings already resolve before you escalate. ### Workflows This Call Plugs Into. #### [Phishing Detection](https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/) When one lookalike registration surfaces, pull the domains its registrant bought in that session. #### [Brand Impersonation](https://www.deepinfo.com/solutions/use-cases/brand-impersonation-protection/) Find the sibling domains of a confirmed impersonation, including ones that are not live yet. #### [Fraud Prevention](https://www.deepinfo.com/solutions/use-cases/fraud-prevention/) Map the full set of domains behind a fraud campaign, not only the one a customer reported. #### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) Scope infrastructure registered together, for attribution and for blocking. ### Other Ways to Cluster a Campaign. - [Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) (Discovery): Domains registered to an email address or email domain. - [Associated Domain Finder](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) (Discovery): Domains that share a registrant, name servers, IP, mail servers or SSL organization. - [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) (Discovery): Filter the whole domain dataset on WHOIS, DNS, certificate and web data. ### See This Data at Work in the Deepinfo Platform Brand Risk Protection matches these newly seen domains against your brand names, down to letters from other alphabets, and keeps the evidence for a takedown. - [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) (BRP) - [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) (BRP) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) ### Questions About Same-Time Registered Domain Finder API **Does the window run before and after the seed?** Yes. A domain matches when the same registrant registered it within `interval` minutes of the seed, earlier or later. **Can we list the batch in the order it was registered?** Yes. `ordering=domain.whois.create_date` returns the matches in registration order, and a `-` prefix puts the newest first. **How do we look beyond one registration session?** Pivot on what the batch shares instead of the time: [Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) on the registrant’s address, or the [Associated Domain Finder](https://www.deepinfo.com/data-api/apis/associated-domain-finder/) on name servers, IP and mail servers. **How is the Same-Time Registered Domain Finder priced?** As part of an API services plan, priced by volume and frequency, separately from the Deepinfo Platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Is the domain we pass part of the result?** Yes. It comes back among the matches, next to the domains registered around it. ### Bring One Domain. Find Its Batch. Take a domain from a recent case and see what its registrant bought alongside it. We set up access and talk through window sizes for your detection workflow on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)