Same-Time Registered Domain Finder API
Find the Rest of a Batch Registered Minutes Apart.
The Same-Time Registered Domain Finder API takes one domain and returns the domains the same registrant registered within minutes of it, in a window you can widen with interval. Campaign infrastructure is often bought in one sitting, so one domain that surfaces can lead you to the rest.
- acme-verify.example 08:13:02 UTC, inside the default window
- acme-secure-pay.example 08:14:47 UTC, inside the default window
- acme-account-help.example 08:19:05 UTC, inside the 15-minute window only
- ±5 min default
-
±15 min
interval=15
A Seed Domain Anchors the Time Window.
The seed’s registration anchors the window, and only domains from the seed’s registrant count. Results use the shared Discovery finder envelope.
| Parameter | Type | Description | |
|---|---|---|---|
domain | string | Required | The seed domain, for example acme-login.example. |
interval | integer | Optional | Window in minutes, from 1 to 60. Default 5. Domains the same registrant registered within this many minutes of the seed match. |
include_ | boolean | Optional | Default false. Set true to return matching subdomains as well as registered domains. |
page | integer | Optional | Page number, from 1. |
page_ | integer | Optional | Results per page. See pagination. |
ordering | string | Optional | Field to sort by. Prefix - for descending. |
export | boolean | Optional | Return the result set as an export instead of a page. Default false. |
export_ | string | Optional | json or csv. |
export_ | string | Optional | How much of each record to include: basic, default or extended. |
Request
curl "https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain=acme-login.example&interval=15&page_size=25" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/discovery/sametime-domain-finder",
params={"domain": "acme-login.example", "interval": 15, "page_size": 25},
headers={"apikey": "YOUR_API_KEY"},
)
for d in r.json()["results"]:
whois = (d.get("domain") or {}).get("whois") or {}
print(whois.get("create_date"), d["punycode"])const r = await fetch(
'https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain=acme-login.example&interval=15&page_size=25',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { result_count, results } = await r.json()
console.log(result_count, results.map((d) => d.punycode))Response
{
"page": 1,
"page_size": 25,
"result_count": 3,
"results": [
{
"punycode": "acme-verify.example",
"unicode": "acme-verify.example",
"is_idn": false,
"type": 1,
"domain": {
"whois": {
"create_date": "2026-09-14T08:13:02Z",
"registrar": "…",
"registrant": { "…": "…" },
"…": "…"
},
"…": "…"
},
"dns": { "a": { "ip_addresses": ["192.0.2.41"] }, "…": "…" },
"ssl": { "…": "…" },
"webdata": { "…": "…" }
},
{ "punycode": "acme-secure-pay.example", "…": "domain record" },
{ "punycode": "acme-account-help.example", "…": "domain record" }
]
}An interval outside 1 to 60, like any invalid parameter, returns a 400 that names it. See errors. Plan-dependent rate limits apply, one request per second by default.
Start Tight and Widen With Care.
1 to 5 minutes
Tight
The default is 5 minutes. A tight window keeps a busy registrant’s unrelated purchases out of the result.
15 to 60 minutes
Wide
For batches registered over a longer session. Expect more results from busy registrant accounts, and check them against DNS and hosting before you act.
In each result
Evidence Attached
Each match is a full domain record with WHOIS, DNS, certificate and web data, so you can see which siblings already resolve before you escalate.
Workflows This Call Plugs Into.
Phishing Detection
When one lookalike registration surfaces, pull the domains its registrant bought in that session.
Brand Impersonation
Find the sibling domains of a confirmed impersonation, including ones that are not live yet.
Fraud Prevention
Map the full set of domains behind a fraud campaign, not only the one a customer reported.
Incident Investigation
Scope infrastructure registered together, for attribution and for blocking.
See This Data at Work in the Deepinfo Platform
Brand Risk Protection matches these newly seen domains against your brand names, down to letters from other alphabets, and keeps the evidence for a takedown.
Questions About Same-Time Registered Domain Finder API
Does the window run before and after the seed?
Yes. A domain matches when the same registrant registered it within interval minutes of the seed, earlier or later.
Can we list the batch in the order it was registered?
Yes. ordering=domain.whois.create_ returns the matches in registration order, and a - prefix puts the newest first.
How do we look beyond one registration session?
Pivot on what the batch shares instead of the time: Reverse WHOIS Email on the registrant’s address, or the Associated Domain Finder on name servers, IP and mail servers.
How is the Same-Time Registered Domain Finder priced?
As part of an API services plan, priced by volume and frequency, separately from the Deepinfo Platform. See Data & API pricing.
Is the domain we pass part of the result?
Yes. It comes back among the matches, next to the domains registered around it.
Bring One Domain. Find Its Batch.
Take a domain from a recent case and see what its registrant bought alongside it. We set up access and talk through window sizes for your detection workflow on a short call.