Security Vendors
Spend Your Engineering on the Product.
Ratings, attack surface and threat intelligence products all need the same thing underneath: domains, DNS, WHOIS and certificates for the whole internet, kept current and kept with history. Deepinfo collects it, and your engineers work on the product.
From the index
Into your product
-
API servicesone question per call
-
Data feedswhole datasets as files
Collection Is a Product of Its Own.
Running internet-wide collection means registrations, resolution, certificates and enrichment, every day, before your own product does anything.
Collect
Registrations and Certificates
A domain corpus that stays current, and the certificates the internet serves.
Resolve
DNS and the Web
DNS state over time, ports and the technologies behind each host.
Enrich
Vulnerabilities
CVEs with CVSS, EPSS and CISA KEV, kept current as records change.
Two Ways to Take It.
API services
Ask the Index, One Call at a Time
Lookups, reverse lookups, history, discovery and vulnerability search over one REST API with one apikey header. Rate limits are set by your plan.
Data feeds
Take the Dataset With You
All domains, all subdomains and each day’s registered, updated, deleted and discovered names, as JSON or CSV files.
-
api.deepinfo.com/v1
apikeyheaderAskone call, one answer
Takea whole file, JSON or CSV
-
400M+domains
Ask:Domain Search Domain Detail WHOIS History All TLDs
Take:
all-domainsdaily-registered-domainsdaily-updated-domainsdaily-deleted-domains -
2B+subdomains
Ask:Subdomain Finder
Take:
all-subdomainsdaily-discovered-subdomains -
200B+DNS records
Ask:DNS History Reverse IP Reverse MX Reverse NS
Take:no file, ask per name
-
30B+SSL certificates
Ask:Domain Search, on certificate fields Domain Detail
Take:no file
-
CVE databaseEPSS CISA KEV CWE
Ask:Vulnerability Search Vulnerability Detail
Take:no file
-
Who builds on it
ratings attack surface threat intelligence products
What It Changed for One Customer.
A ratings provider stopped running an internet observatory.
A US-headquartered cybersecurity ratings provider sources its internet-wide data from Deepinfo API Services and Data Feeds, and its engineers spend their time on the scoring model and the product.
The Index Behind It.
Deepinfo’s index holds 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates, collected and resolved by Deepinfo and kept with history. The Deepinfo Platform runs on the same records.
Data is priced separately from the platform, by volume and frequency. Some customers buy only the data.
Questions About Security Vendors
Can we use the data inside our own product?
That is how the ratings provider in our customer stories uses it. How the data can be used and shown in your product is part of the agreement, so talk to the data team about your case.
How do we evaluate the data?
Tell the data team what you are building. They recommend API services, data feeds or both, and set up access so your team can test against its own targets.
Do we need the Deepinfo Platform as well?
No. Data & API is sold on its own. Some customers use both: the platform for their own security team and the data for their product.
What are the API rate limits?
They depend on your plan and apply per key and per endpoint, with a default of one request per second. Responses carry ratelimit-remaining and ratelimit-reset headers, and a call over the limit gets 429.
How are feed files delivered?
As CSV or JSON, through a pre-signed download link that is valid for one hour. The response also reports the file’s size, line count and update time, so a pipeline can check what it fetched.
Is there a streaming or webhook version of the feeds?
Not in the public API. Each feed is a file, and a fresh link comes from calling the feed endpoint again.
Can we get DNS or WHOIS history in bulk?
Not through a public feed. History comes one name per call, through DNS History and WHOIS History, each returning what Deepinfo has observed with the dates it was seen.
Tell Us What You Are Building.
The data team recommends the APIs and feeds that fit, and sets up access for a test against your own targets.