Pivot across the internet's domain corpus from any angle.
Investigations rarely start with the answer. They start with one indicator and pivot outward: find every domain pointing to this IP, every domain registered with this email, every subdomain under this parent. Domain Search is the investigative tool for those pivots, working against Deepinfo's full domain corpus.
Pivot queries across the full domain corpus.
Domain Search exposes structured pivot queries against the corpus: reverse-IP (find every domain pointing to a given IP), reverse-MX (find every domain routing email through a given MX server), reverse-NS (find every domain on a given name server), reverse-WHOIS (find every domain registered with a given email or contact), subdomain enumeration (find every subdomain of a parent), sametime-registered (find every domain registered in a given window), associated-domain (find every domain related to a target through any indicator).
Each query returns structured results: domain, relevant pivot field, registration metadata, current resolution status. Pivot from any result back into another query. The investigative tool that finds the domains your hand-built dataset would have missed.
Three categories of pivot query.
Reverse lookups for infrastructure-shared discovery. Subdomain enumeration for footprint mapping on any target. Time and association queries for coordinated-infrastructure detection.
Reverse lookups.
Reverse-IP, reverse-MX, reverse-NS, reverse-WHOIS. Start from one infrastructure indicator and find every domain that shares it. Foundational for adversary infrastructure mapping and subsidiary discovery.
Subdomain enumeration.
Comprehensive subdomain finder for any parent domain. Built from the same passive DNS, certificate transparency, and crawling sources that power EASM's discovery layer. Works against any target, not just monitored assets.
Time and association queries.
Sametime-registered (find every domain registered in a target window, useful for coordinated infrastructure detection). Associated-domain (find every domain related to a target through any indicator, broader than reverse lookups, surfaces patterns reverse lookups don't).
Examples of pivots Domain Search runs.
Reverse-IP
Every domain pointing to a given IP, including historical resolutions where the dataset preserves them.
Reverse-MX
Every domain routing email through a given MX server, useful for SaaS-vendor and shared-infrastructure mapping.
Reverse-NS
Every domain on a given name server, surfacing domains under shared DNS infrastructure.
Reverse-WHOIS
Every domain registered with a given email or registrant contact, useful for subsidiary and adversary mapping.
Subdomain enumeration
Comprehensive subdomain finder for any parent domain, built from passive DNS, certificate transparency, and crawl sources.
Sametime-registered
Domains registered in a defined time window, useful for coordinated-infrastructure detection across attacker campaigns.
Associated-domain
Domains related to a target through any infrastructure indicator, broader than reverse lookups alone.
Pivot chains
Click-through links from any result into another pivot query, supporting investigation depth without context loss.
Search complements aggregate intelligence.
Domain Search answers specific questions ("which domains match these criteria"). Domain Intelligence answers structural questions ("how is this category trending"). Vulnerability Search and Vulnerability Intelligence apply the same pattern to the CVE corpus. Instant Lookups handle single-target queries with low latency. The five sub-features cover the search-and-investigate workflow at internet scale.
“Investigations live or die on the pivots. Reverse-IP, registration-email, certificate-fingerprint queries all return in seconds, not minutes; the dataset turns one indicator into a full picture inside a single session.”
Explore the full platform.
See your entire attack surface. Act on what matters.
Continuous discovery and monitoring of every internet-facing asset, including subsidiaries and acquired companies.
See module CTI · CYBER THREAT INTELLIGENCESee what’s exposed. Act before it’s exploited.
Dark-web monitoring, breach corpora, infostealer logs, and threat-actor activity tied to your organization.
See module BRP · BRAND RISK PROTECTIONKeep an eye on the internet. Protect your brand.
Lookalike domains, fake apps, fraudulent listings, and brand abuse caught in hours, not weeks.
See module TPRM · THIRD-PARTY RISK MANAGEMENTEvery third party carries risk. See all of it.
Continuous external monitoring of every approved vendor with the same depth as your own surface.
See module DSI · DEEP SEARCH AND INSIGHTSExplore the entire internet. See every layer.
400M domains, 2B subdomains, 200B DNS records, 30B SSL certificates. All queryable directly.
See moduleTry a domain pivot against your own indicators.
Book a demo. We'll run live pivot queries against indicators you bring.