Request demo

Threat Hunting

Test the Hypothesis Against the Whole Index.

A hunt starts with a hunch: this actor is looking at our sector, this pattern keeps coming back, this CVE is being used against organizations like ours. Threat Hunting checks it against the index behind the Deepinfo Platform and a CVE database enriched with EPSS and CISA KEV.

Request demoDiscovery API reference

Query

HypothesisDomains on the same name server, registered in the same window, with mail servers in place

  1. must dns.ns.name_servers eq "ns1.dns-host.example"
  2. must domain.whois.create_date gte 2026-08-01T00:00:00Z
  3. must dns.mx.mail_servers exists true

Results

  1. northwind.example
  2. blue-harbor.example

The Hypotheses a Hunt Starts From.

Indicator-driven

Start From an IOC

An IP, a domain, a mail server or a registrant email from an alert. Reverse lookups return every domain that shares it, and each result is a new starting point.

Actor-driven

Start From an Actor

Filter Threat Actor Intelligence by the countries and industries you operate in, read the CVEs and tools each actor uses, then look for those CVEs on your surface.

Pattern-driven

Start From a Pattern

Describe the infrastructure you expect to find: one name server, a registration window, mail servers in place. Domain Search returns what matches.

Describe the Infrastructure and Get the Matches.

Domain Search filters the whole domain dataset on names, subdomains, WHOIS, DNS, IP history, SSL and web data, with must, should and must_not logic.

The request here looks for domains on one name server, registered since the start of August 2026, that already have mail servers. Swap the filters and that request tests a different hypothesis.

Results come back as full domain records, paged or exported as JSON or CSV.

Domain Search reference
Domain Search 
curl -X POST \
  "https://api.deepinfo.com/v1/discovery/domain-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "dns.ns.name_servers", "type": "eq",
          "value": "ns1.dns-host.example" },
        { "name": "domain.whois.create_date", "type": "gte",
          "value": "2026-08-01T00:00:00Z" },
        { "name": "dns.mx.mail_servers", "type": "exists", "value": true }
      ]
    }
  }'

The Pivots a Hunt Keeps Reaching For.

Each question is one request. The answer is a list of domain records, and any field in them can seed the next request.

QuestionEndpointReturns
What else sits on this IP or network?GET /discovery/reverse-ipDomains resolving to an IP, or to its /8, /16 or /24 network
What else uses this mail server?GET /discovery/reverse-mxDomains using the mail server, or the whole mail domain with apex
What else uses this name server?GET /discovery/reverse-nsDomains using the name server
What else did this registrant register?GET /discovery/reverse-emailDomains whose WHOIS registrant email matches
What was registered alongside it?GET /discovery/sametime-domain-finderDomains the same registrant registered within 1 to 60 minutes
What shares its registrant or servers?GET /discovery/associated-domain-finderDomains sharing registrant email, organization or phone, name servers, IP, mail servers or SSL organization
What did it resolve to before?GET /analyze/dns-historyEvery distinct DNS value observed, with the times it was seen
Which CVEs fit the profile?POST /discovery/vulnerability-searchCVEs filtered on their full record, including EPSS and CISA KEV

Parameters and response fields are in the Discovery and Vulnerability references.

From an Actor Profile to Your Assets.

  1. 01

    Select

    Search Threat Actor Intelligence for actors that target your countries or your industry.

  2. 02

    Read

    Take the CVEs each remaining actor is known to use from its capabilities, along with its tools.

  3. 03

    Rank

    Look each CVE up with its EPSS probability and CISA KEV status, and put the exploited ones first.

  4. 04

    Check

    Search your External Attack Surface Management inventory for those CVEs. What comes back is the hunt’s answer, or its next question.

Where Hunts Lead Next.

Use case Domain Intelligence and Research Pivots, searches and registration statistics on the domain layer. Read Use case Incident Investigation and Response The index, pointed at an open incident. Read Customer story A cybersecurity ratings provider Builds its own product on the index, through APIs and Data Feeds. Read

Use This Data in Your Tools

Analysts can pivot through these records from their own tools: what else sits on an IP address, what a domain resolved to before, and who registered it.

Questions About Threat Hunting

Do hunts need the platform or the API?

Either. Analysts run searches and pivots in Deep Search & Insights, and the same queries are REST endpoints behind one apikey header, so a hunt that works once can be scheduled.

How fresh is the data behind a pivot?

WHOIS, DNS, IP WHOIS and SSL lookups query the target or its registry at request time and stamp each answer with check_date. Finders, searches and history read what the index has observed, with the times each value was seen.

Can results be exported in bulk?

Yes. The Discovery finders and the searches take export=true and return JSON or CSV. A single search returns a capped number of results, so broad hunts get narrowed with filters rather than paged.

Does an empty result mean the infrastructure doesn’t exist?

No. It means the index holds no match. A host can run for a while before Deepinfo first observes it, so an empty answer is a reason to widen the hypothesis before ruling it out.

What are the API rate limits?

They depend on your plan and apply per key and per endpoint, one request per second by default. Responses carry headers with the remaining allowance, so a scheduled hunt can pace itself. See rate limits.

Where do IOC feeds fit?

Indicator-driven hunts often start from one. IOC Feeds cover the indicators the platform structures, such as lookalike domains, dark web indicators and the CVEs actors use, scoped with your team.

Bring a Hypothesis. We’ll Run It Live.

Book a working session and test a hunting hypothesis of yours against the index with our team.

Request demo