# Domain Intelligence and Research

URL: https://www.deepinfo.com/solutions/use-cases/domain-intelligence-and-research/

## Research Any Domain and Who Stands Behind It.

Domain research starts with an IP address, a mail server, a registrant email or a name, and works outward. [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) runs the searches and pivots for the question in front of you, and the registration statistics for the trend behind it.

[Request demo](https://www.deepinfo.com/request-demo/) · [Discovery API reference](https://docs.deepinfo.com/reference/discovery/)

### The Corpus Under Every Query.

Each layer is collected by Deepinfo and kept with its history. The searches, pivots and statistics on this page all read from them.

- 400M+ domains: across every TLD
- 2B+ subdomains: discovered and resolved
- 200B+ DNS records: cumulative, with history
- 30B+ SSL certificates: indexed

### How Each Team Uses Domain Research.

Threat intelligence

#### Mapping Infrastructure

Start from an indicator in a report and find the rest of the infrastructure behind it.

Fraud and brand

#### Finding the Rest of a Campaign

Start from one phishing domain and find the others registered with it, hosted with it or mailed from shared servers.

Research

#### Measuring the Domain Space

Registration counts, top TLDs and top keywords over 1, 7, 30 and 365 days: the statistics behind the public [domain insights](https://www.deepinfo.com/insights/domain/) page.

Journalism

#### Following Ownership

Registration records and their history show who held a domain and when that changed, where the registry publishes it.

### Each Relationship Takes One Request.

Each finder answers one relationship question and returns full domain records, so any field in the answer can seed the next question.

- **[Subdomain Finder](https://www.deepinfo.com/data-api/apis/subdomain-finder/)**: From a domain: every known subdomain.
- **[All TLDs](https://www.deepinfo.com/data-api/apis/all-tlds/)**: From a domain: the same name under other TLDs.
- **[Reverse IP](https://www.deepinfo.com/data-api/apis/reverse-ip/)**: From an IP, optionally with a /8, /16 or /24 mask: the domains resolving to it.
- **[Reverse MX](https://www.deepinfo.com/data-api/apis/reverse-mx/)**: From a mail server: the domains using it, or the whole mail domain with `apex`.
- **[Reverse NS](https://www.deepinfo.com/data-api/apis/reverse-ns/)**: From a name server: the domains using it.
- **[Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/)**: From a registrant email: the domains registered with it, or with any address on its domain with `apex`.
- **[Same-Time Registered Domain Finder](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/)**: From a domain: what the same registrant registered within 1 to 60 minutes of it.
- **[Associated Domain Finder](https://www.deepinfo.com/data-api/apis/associated-domain-finder/)**: From a domain: the domains sharing its registrant email, organization or phone, name servers, IP, mail servers or SSL organization.

Results are paged and export as JSON or CSV. [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) covers the questions the finders don’t, with filters across the whole domain record.

### Find What Was Registered Alongside It.

A registrant setting up several domains at once leaves them with neighboring timestamps. This finder returns what the same registrant registered within a window you choose.

GET `https://api.deepinfo.com/v1/discovery/sametime-domain-finder` [Reference](https://docs.deepinfo.com/reference/discovery/same-time-registered-domain-finder/)

| Parameter | Type |  | Description |
| --- | --- | --- | --- |
| `domain` | string | Required | The domain whose registration is the reference point. |
| `interval` | integer | Optional | Window in minutes, 1 to 60. Default 5. |
| `page_size` | integer | Optional | Results per page, 25 to 100. Default 100. |

Request

curl:

```bash
curl "https://api.deepinfo.com/v1/discovery/sametime-domain-finder?domain=acrne.example&interval=10&page_size=25" \
  -H "apikey: YOUR_API_KEY"
```

Python:

```python
import requests

r = requests.get(
    "https://api.deepinfo.com/v1/discovery/sametime-domain-finder",
    params={"domain": "acrne.example", "interval": 10, "page_size": 25},
    headers={"apikey": "YOUR_API_KEY"},
)
for d in r.json()["results"]:
    print(d["punycode"])
```

JavaScript:

```javascript
const q = new URLSearchParams({ domain: 'acrne.example', interval: 10, page_size: 25 })
const r = await fetch(
  `https://api.deepinfo.com/v1/discovery/sametime-domain-finder?${q}`,
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const { results } = await r.json()
results.forEach((d) => console.log(d.punycode))
```

Response

200 OK · application/json

```json
{
  "page": 1,
  "page_size": 25,
  "result_count": 3,
  "results": [
    { "punycode": "acrne-login.example", "is_idn": false, "…": "domain record" },
    { "punycode": "acrne-pay.example", "is_idn": false, "…": "domain record" },
    { "punycode": "acrne-support.example", "is_idn": false, "…": "domain record" }
  ]
}
```

### Build on This Index.

- [A cybersecurity ratings provider](https://www.deepinfo.com/customers/cybersecurity-ratings-provider/) (Customer story): Scoring data sourced from Deepinfo APIs and Data Feeds.
- [Researcher Program](https://www.deepinfo.com/programs/researcher/): Access to the dataset for qualifying research.
- [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) (Use case): These pivots, driven by a hypothesis.

### Questions About Domain Intelligence and Research

**Can we research domains we don’t own?**

Yes. The finders and searches read Deepinfo’s index, so they work for any registered domain: a supplier, an acquisition target or a domain under investigation.

**What happens when WHOIS is privacy-protected?**

Registrant-based pivots such as reverse WHOIS email only work where the registry publishes the data. Infrastructure pivots on IP, name servers, mail servers and certificate organization still work, and WHOIS history can show what was published before privacy was switched on.

**How far back does the history go?**

It depends on the domain. DNS History returns each value Deepinfo has observed with its observation times, and WHOIS History each distinct record with its dates, so the oldest entry is the earliest observation the index holds.

**Do the finders catch lookalike domains?**

No. The finders follow shared attributes such as an IP address, a name server or a registrant. For typos and swapped letters, use `fuzzy` in [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/), or let [Brand Risk Protection](https://www.deepinfo.com/platform/brp/) match your brand names continuously.

**What if a search matches too many domains?**

A search reports the full match count, and the results it returns are capped. For broad questions, narrow the query with filters, or use the bulk [data feeds](https://www.deepinfo.com/data-api/feeds/) for whole-dataset work.

**Can we run these from our own code?**

Yes. Each finder, search and history call is a REST endpoint behind one `apikey` header. Which endpoints you can call, and your rate limits, depend on your plan.

**Is there access for academic or journalistic research?**

Qualifying researchers can apply to the [Researcher Program](https://www.deepinfo.com/programs/researcher/). Tell us what you are studying and which parts of the dataset you need.

### Bring an Indicator. Follow It With Us.

Book a working session and run live pivots from an indicator you bring, or talk to us about API access for your team.

[Request demo](https://www.deepinfo.com/request-demo/) [Talk to us about API access](https://www.deepinfo.com/contact/)