Domain Search

Pivot From One Indicator to the Domains That Share It.

Q: Can we export the results?

Yes. Add export=true with export_format (json or csv) and export_scope (basic, default or extended) to Domain Search or to any finder.

Investigations rarely start with the answer. They start with an IP, a mail server, a registrant email or a name that looks wrong, and work outward.

Domain Search filters Deepinfo’s domain index on all the layers of a domain’s record, and the finders pivot from a single indicator in one call. Each result is a full domain record, so the next pivot starts from what you just found.

Request demo Domain Search reference Platform guide: Domain search

IP 203.0.113.24

Reverse IP GET /discovery/reverse-ip
- staging.acme.example (the next pivot starts here)
  - WHOIS
  - DNS
  - IP history 203.0.113.24 · 198.51.100.7
  - SSL self-signed
  - Web data
- partner-portal.example
Reverse MX GET /discovery/reverse-mx
- acme-mail.example
- shop.acme.example

Export JSON / CSV

Filters Go In and Domain Records Come Out.

One body carries all the conditions. All must conditions have to match, at least one should condition has to match, and nothing in must_not may match.

POST https://api.deepinfo.com/v1/discovery/domain-search Reference

Parameter	Type		Description
`filters`	object	Optional	In the body. Conditions under `must`, `should` and `must_not`, each a field `name`, an operator `type` and a `value`.
`sort`	array	Optional	In the body. One or more `{field, order}` pairs.
`page`	integer	Optional	Page number, from 1.
`page_size`	integer	Optional	Results per page.
`export`	boolean	Optional	Export the results instead of paging through them.
`export_format`	string	Optional	`json` or `csv`.
`export_scope`	string	Optional	How much of each record to export: `basic`, `default` or `extended`.

Request

curl -X POST \
  "https://api.deepinfo.com/v1/discovery/domain-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "filters": {
    "must": [
      { "name": "domain",
        "type": "eq", "value": "acme.example" }
    ],
    "should": [
      { "name": "ssl.signature.is_self_signed",
        "type": "eq", "value": true },
      { "name": "ssl.signature.is_valid",
        "type": "eq", "value": false }
    ]
  },
  "sort": [
    { "field": "ssl_last_change_date", "order": "desc" }
  ]
}'

import requests

must = [{"name": "domain", "type": "eq", "value": "acme.example"}]
should = [
    {"name": "ssl.signature.is_self_signed",
     "type": "eq", "value": True},
    {"name": "ssl.signature.is_valid",
     "type": "eq", "value": False},
]
body = {
    "filters": {"must": must, "should": should},
    "sort": [{"field": "ssl_last_change_date", "order": "desc"}],
}
r = requests.post(
    "https://api.deepinfo.com/v1/discovery/domain-search",
    params={"page_size": 25},
    json=body,
    headers={"apikey": "YOUR_API_KEY"},
)
for record in r.json()["results"]:
    print(record["punycode"])

const url = 'https://api.deepinfo.com/v1/discovery/domain-search?page_size=25'
const filters = {
  must: [{ name: 'domain', type: 'eq', value: 'acme.example' }],
  should: [
    { name: 'ssl.signature.is_self_signed', type: 'eq', value: true },
    { name: 'ssl.signature.is_valid', type: 'eq', value: false },
  ],
}
const r = await fetch(url, {
  method: 'POST',
  headers: {
    apikey: 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    filters,
    sort: [{ field: 'ssl_last_change_date', order: 'desc' }],
  }),
})
const { results } = await r.json()
results.forEach((d) => console.log(d.punycode))

Response

200 OK · application/json

{
  "page": 1,
  "page_size": 25,
  "result_count": 2,
  "results": [
    {
      "punycode": "staging.acme.example",
      "unicode": "staging.acme.example",
      "is_idn": false,
      "type": 2,
      "domain": { "…": "the parent domain: name, WHOIS, DNS" },
      "dns": { "a": { "ip_addresses": ["203.0.113.24"] }, "…": "…" },
      "ip_history": ["203.0.113.24", "198.51.100.7"],
      "ssl": {
        "issuer": { "common_name": "staging.acme.example", "…": "…" },
        "signature": { "is_self_signed": true, "…": "…" },
        "…": "fqdns, validity, fingerprint, extensions"
      },
      "webdata": { "…": "…" }
    },
    "…"
  ]
}

Browse the Fields Family by Family.

Several fields come in two forms, one for the name itself and one for its registered domain, such as dns.a.ip_addresses and domain.dns.a.ip_addresses, so a filter can target a host’s own records or its parent’s.

Name and extension	Name, extension and extension type, length, language, keywords, digits and hyphens, internationalized and confusable characters
Subdomain	Subdomain label, first and last label, nesting depth, length
WHOIS	Registrar, creation, update and expiry dates, registrant organization and country, name servers, status codes, privacy, past registrant emails
DNS	A, AAAA, NS, MX, SOA, TXT, CNAME and other record values, each with its update date, plus when DNS last changed
IP history	Every IP address the name, or its domain, has resolved to
SSL	Issuer, subject, alternative names, validity dates and length, SHA-256, SHA-1 and MD5 fingerprints, self-signed and signature flags
Web data and HTTP	Connection status, first and last status codes, redirect chain, final URL, security headers, cookies, page hashes

Operators follow the field type: gte and lte take numbers and dates, contains_any and contains_all take array fields. The Domain Search reference lists the fields under Filtering.

Operators Match and Clauses Combine.

Operators decide how one condition matches. Clauses decide how conditions combine: all of must, at least one should, none of must_not.

Together they fit a whole investigation into one body. Every domain on one name server, registered this year, with mail servers, excluding the domains you own, is four conditions.

Search and filters guide

filter.json

{
  "filters": {
    "must": [
      { "name": "dns.ns.name_servers",
        "type": "eq",
        "value": "ns1.hosting.example" },
      { "name": "domain.whois.create_date",
        "type": "gte", "value": "2026-01-01T00:00:00Z" },
      { "name": "dns.mx.mail_servers",
        "type": "exists", "value": true }
    ],
    "must_not": [
      { "name": "domain", "type": "in",
        "value": ["acme.example",
          "acme-group.example"] }
    ]
  }
}

On one name server ({ name: dns.ns.name_servers, type: eq, value: ns1.hosting.example })
Registered this year ({ name: domain.whois.create_date, type: gte, value: 2026-01-01T00:00:00…)
With mail servers ({ name: dns.mx.mail_servers, type: exists, value: true })
Not a domain you own ({ name: domain, type: in, value: [acme.example, acme-group.example] })

`eq`, `in`	The exact value, or any of several
`startswith`, `endswith`	A prefix or a suffix, such as hosts that start with `login.`
`wildcard`	A pattern, with `?` for one character and `*` for any run
`fuzzy`	An approximate match, for names a few characters away from a brand
`contains_any`, `contains_all`	Array fields that hold any, or all, of the values
`gte`, `lte`	Numbers and dates, alone or as a range
`exists`	A field that has a value, or has none

Each Pivot in One Call.

When the question starts from a single indicator, a finder is shorter than a search. Each returns full domain records and exports like a search.

Finder	Starts from	Options
Reverse IP	An IP address	`mask` of 8, 16 or 24 widens the match to the address’s network
Reverse MX	A mail server	`apex` matches all mail servers under that domain
Reverse NS	A name server	`apex` matches all name servers under that domain
Reverse WHOIS Email	A registrant email	`apex` matches any address at the email’s domain
Same-Time Registered	A domain	Same registrant, within `interval` minutes: 1 to 60, default 5
Associated Domains	A domain	`association` picks the shared signals: registrant email, organization or phone, name servers, IP, mail servers, SSL organization. `strict` requires all of them
Subdomain Finder	A domain	All known subdomains
All TLDs	A domain	The name under other extensions

All finders take page, page_size, ordering and the export parameters, and all except Subdomain Finder take include_subdomains. See the Discovery reference.

Common Investigations Take One Request Each.

Each is one Domain Search body, built from the fields above. The API sample at the top of this page is the weak-certificate search.

Weak Certificates Under Your Domain

Hosts under one domain whose certificate is self-signed or fails signature validation, most recent change first.

Live Sites Without HSTS

Sites with a success connection status and no strict_transport_security header in the response.

Missing Clickjacking Protection

Sites that answered with neither an X-Frame-Options header nor a Content Security Policy.

Redirects to Another Site

Names whose first response is a 301 or 302 that sends visitors to a different site.

Look-Alikes That Take Mail

fuzzy on domain.name, created since a date, dns.mx.mail_servers present, your domain in must_not.

Confusable Internationalized Names

Names where is_idn and name.contains_confusable are both true: the raw material of homoglyph lookalikes.

Domain Search examples

Questions About Domain Search

When should we use a finder instead of Domain Search?

Use a finder when the question starts from one indicator, such as an IP, a mail server, a registrant email or a domain. Use Domain Search when you are describing a set of domains by several properties at once.

What is a domain record?

The unit that searches and finders return: the name and its analysis (language, keywords, internationalized and confusable flags), WHOIS with normalized and historical fields, DNS by record type, IP history, the SSL certificate and web data. Domain Detail returns the same record for a single domain.

Does Domain Search cover subdomains?

Yes. The index holds registered domains and the hostnames under them, and the type field tells them apart. The Subdomain family filters on the labels themselves, and domain returns every name under one registered domain.

How current is a domain record?

Each DNS value carries its own update date, and the record notes when DNS and the certificate last changed. For the answer as it stands right now, run an Instant Lookup on the result.

Can we find domains registered behind a privacy service?

Yes, through every layer except the hidden registrant: DNS, certificates, IP history and web data still describe them, and WHOIS privacy is itself a searchable field. A registrant that a privacy service hides can’t be matched in a reverse WHOIS search.

Can we export the results?

Yes. Add export=true with export_format (json or csv) and export_scope (basic, default or extended) to Domain Search or to any finder.

Bring an Indicator. We’ll Pivot It Live.

Book a demo with an IP, a mail server, a registrant email or a brand name your team is watching. We run the searches and pivots with you, on the real index.

Request demo Talk to us about API access

Platform

Solutions

Data & API

Resources

Company