# Instant Lookups URL: https://www.deepinfo.com/platform/dsi/instant-lookups/ ## Check Any Domain, IP or URL as It Is Now. Triage and incident response run on small questions: what does this name resolve to, who registered it, which certificate does it serve, which ports answer. Instant Lookups puts each question to the target, or to its registry, at the moment you ask. WHOIS, DNS and SSL answers carry the raw response next to the parsed fields. When the current answer isn’t enough, DNS History and WHOIS History show what the record used to be. [Request demo](https://www.deepinfo.com/request-demo/) · [Lookup reference](https://docs.deepinfo.com/reference/lookup/) · [Platform guide: Instant lookups](https://docs.deepinfo.com/guide/dsi/instant-lookup/) ### One Lookup for Each Question. The `/lookup/` endpoints query the target live. DNS History and WHOIS History read what Deepinfo has recorded for it. | Lookup | Endpoint | Returns | | --- | --- | --- | | [Domain WHOIS](https://www.deepinfo.com/data-api/apis/whois-lookup/) | `GET /lookup/whois` | Registrar, creation, update and expiry dates, name servers and status codes, raw and parsed | | [DNS](https://www.deepinfo.com/data-api/apis/dns-lookup/) | `GET /lookup/dns` | Current records for a name, several record types in one call, with the zone-file form beside the parsed values | | [IP WHOIS](https://www.deepinfo.com/data-api/apis/ip-whois-lookup/) | `GET /lookup/ip-whois` | The owning network and its range, the ASN, the registry and the contact entities | | [SSL](https://www.deepinfo.com/data-api/apis/ssl-lookup/) | `GET /lookup/ssl` | The certificate a host serves, parsed, with signature, chain and expiry verdicts | | [Port Scan](https://www.deepinfo.com/data-api/apis/port-scan/) | `POST /lookup/port-scan` | Open TCP and UDP ports and the services behind them, with optional version and OS detection | | [Technology](https://www.deepinfo.com/data-api/apis/technology-lookup/) | `GET /lookup/technology` | The technologies a site runs, each with category, version, confidence and a CPE name | | [Screenshot](https://www.deepinfo.com/data-api/apis/screenshot-lookup/) | `GET` or `POST /lookup/screenshot` | A browser capture of the page, as a signed link | | [Web Data](https://www.deepinfo.com/data-api/apis/webdata-lookup/) | `GET /lookup/webdata` | Everything extracted from a loaded page, in one response | | [DNS History](https://www.deepinfo.com/data-api/apis/dns-history/) | `GET /analyze/dns-history` | Every distinct record value Deepinfo has observed for a name, with each time it was seen | | [WHOIS History](https://www.deepinfo.com/data-api/apis/whois-history/) | `GET /analyze/whois-history` | Each distinct registration record of a domain, with the dates it was seen | Each name links to that lookup’s API page. Parameters and response fields are in the [Lookup reference](https://docs.deepinfo.com/reference/lookup/). ### A Certificate Check With a Clear Verdict. The lookup opens a TLS connection to the host and parses the certificate it serves. If the connection fails, the answer still arrives, with the reason in `connection_status`: `timeout`, `refused`, `reset`, `ssl_error`, `not_resolved` or `proxy_connection_error`. GET `https://api.deepinfo.com/v1/lookup/ssl` [Reference](https://docs.deepinfo.com/reference/lookup/ssl/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `target` | string | Required | The host to connect to, for example `deepinfo.com`. | | `port` | integer | Optional | The port to connect to. Default `443`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/lookup/ssl", params={"target": "deepinfo.com"}, headers={"apikey": "YOUR_API_KEY"}, ) cert = r.json()["parsed"] print(cert["validity"]["end"], cert["signature"]["valid_chain"]) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com', { headers: { apikey: 'YOUR_API_KEY' } } ) const { parsed } = await r.json() console.log(parsed.validity.end, parsed.signature.valid_chain) ``` Response 200 OK · application/json ```json { "target": "deepinfo.com", "port": 443, "connection_status": "success", "parsed": { "subject": { "dn": "CN=deepinfo.com", "common_name": "deepinfo.com", "…": "…" }, "issuer": { "dn": "CN=WE1,O=Google Trust Services,C=US", "common_name": "WE1", "organization": "Google Trust Services", "…": "…" }, "validity": { "start": "2026-08-22T16:13:55Z", "end": "2026-11-20T17:13:40Z", "length": 7779585 }, "signature": { "valid": true, "valid_chain": true, "self_signed": false, "invalid_reason": null, "…": "…" }, "fingerprint_sha256": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50", "fingerprint_sha1": "…", "fingerprint_md5": "…", "has_expired": false, "fqdn_list": ["deepinfo.com"], "extensions": { "…": "key_usage, extended_key_usage, basic_constraints, …" } }, "certificate": "MIIDfTCCAySgAwIBAgIR…", "parse_errors": [], "check_date": "2026-09-22T12:26:02Z" } ``` ### Lookups That Load the Page. These load the site itself instead of querying a record about it. Screenshot and Web Data open it in a real browser, so they see what a visitor sees. Technology #### What the Site Runs CMS, web frameworks, JavaScript libraries, CDN, analytics and chat widgets, each with its category, its version when visible, a confidence from 0 to 100 and a CPE name. The CPE name is what links a technology to CVE records. [Technology API](https://www.deepinfo.com/data-api/apis/technology-lookup/) Screenshot #### What the Page Looks Like A custom viewport, full-page capture, mobile emulation, JPEG or PNG, ad and cookie-banner blocking, or a single element by CSS selector. The result is a signed link that stays valid for seven days. [Screenshot API](https://www.deepinfo.com/data-api/apis/screenshot-lookup/) Web Data #### Everything on the Page Title, description, Open Graph and JSON-LD, source and visible text with hashes, links, scripts, trackers, email addresses, favicons, `robots.txt`, response headers, cookies and the redirect chain. Add `screenshot=true` for a capture in the same call. [Web Data API](https://www.deepinfo.com/data-api/apis/webdata-lookup/) ### When the Current Answer Is Not Enough. A live lookup tells you where a name resolves today. An investigation often needs to know where it resolved on the day something happened. DNS History returns the distinct values Deepinfo has observed for a name, each with the times it was seen, including values that have since changed or been removed. WHOIS History does the same for registration records. [DNS History reference](https://docs.deepinfo.com/reference/lookup/dns-history/) · [WHOIS History reference](https://docs.deepinfo.com/reference/lookup/whois-history/) Request: ```bash curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A" \ -H "apikey: YOUR_API_KEY" ``` Response: ```json { "fqdn": "deepinfo.com", "dn": "deepinfo.com", "subdomain": null, "records": [ { "type": "a", "values": [ { "value": "104.26.10.21", "time": ["2026-09-18T05:41:26Z", "2026-09-05T21:26:18Z", "2026-08-16T16:37:59Z"] }, { "value": "172.67.70.198", "time": ["2026-09-18T05:41:26Z", "…"] }, "…" ] } ] } ``` ### What to Expect From Each Call. - **Live and stored**: The `/lookup/` endpoints query the target, or its registry, when you call them, and stamp the answer with `check_date`. The `/analyze/` endpoints read the history Deepinfo has recorded. - **Quota**: Lookups count against your plan’s quota at one unit per request. A DNS lookup that asks for several record types is still one unit. - **Rate limits**: Plan-dependent. The default is one request per second per key and endpoint. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/). - **Port Scan**: TCP and UDP, port lists and ranges, `light` or `full` mode. A scan runs for at most 85 seconds. Only scan hosts you own or are authorized to test. - **Screenshots**: Screenshot links are pre-signed and expire after seven days. Save the image if you need it for longer. - **Errors**: Gateway and application errors each have a documented format, and each response carries a `deepinfo-request-id` header. See [errors](https://docs.deepinfo.com/getting-started/errors/). ### Start From One Target, Then Search the Whole Index. - [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/) (DSI): Pivot from the IP, mail server or name server you just looked up to the domains that share it. - [Vulnerability Search](https://www.deepinfo.com/platform/dsi/vulnerability-search/) (DSI): Turn a technology’s CPE name into the CVEs that affect it. - [Incident Investigation and Response](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) (Use case): An indicator’s DNS, WHOIS, certificate and network owner, then its history on the day it started. ### Questions About Instant Lookups **Are live lookups served from a cache?** No. The `/lookup/` endpoints query the target, or its registry, at request time and stamp the answer with `check_date`. For stored observations, use DNS History, WHOIS History or [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/). **Where do WHOIS answers come from?** Domain WHOIS queries the registration record in real time and returns the raw text next to the parsed fields. IP WHOIS reads the regional internet registries for the owning network, its range and its ASN. **Why do some lookups take longer?** Technology, Screenshot and Web Data load the site itself instead of reading a record, so they take longer than a DNS or WHOIS lookup. Set your client timeouts with that in mind. **Can we scan any host?** Only hosts you own or are authorized to test. That condition applies to every Port Scan request and is stated in the [Port Scan reference](https://docs.deepinfo.com/reference/lookup/port-scan/). **Can we run lookups in bulk?** Each call answers for one target, so bulk work means one call per target within your rate limit. When the answer is already in the index, [Domain Search](https://www.deepinfo.com/platform/dsi/domain-search/) and the [data feeds](https://www.deepinfo.com/data-api/feeds/) cover many domains at once. ### Run the Lookups on Your Targets. Book a demo and bring the domains, IPs and URLs from your last investigation. We run the live lookups and the history with you. [Request demo](https://www.deepinfo.com/request-demo/) [Talk to us about API access](https://www.deepinfo.com/contact/)