Associated Domain Finder API
From One Domain to the Portfolio Behind It.
Pass a seed domain. The API finds the other domains that share its registrant email, organization or phone, its name servers, IP or mail servers, or the organization on its certificate.
Choose the signals with association. Set strict=true when all chosen signals have to match.
seed acme.example
- Registrant email
- acme-group.examplecreated 2014-02-11
- acme-labs.example
- acme-retail.example
- Registrant organization (not used in this call)
- Registrant phone (not used in this call)
- Name servers (not used in this call)
- IP address (not used in this call)
- Mail servers (not used in this call)
- SSL organization (not used in this call)
Matched on whois_registrant_email, whois_registrant_email_apex_normalized
Pick a Seed and the Signals to Match On.
The response echoes the signals that were requested and the ones that could be applied to this seed. A seed behind WHOIS privacy has no registrant email to match on, which the second list makes visible.
| Parameter | Type | Description | |
|---|---|---|---|
domain | string | Required | The seed, a registered domain such as acme.example. |
association | string | Optional | The signal or signals to match on: registrant email, organization or phone, name servers, IP, mail servers or SSL organization. |
strict | boolean | Optional | Require every requested signal to match. Default false. |
include_ | boolean | Optional | Include matching subdomains as well. Default false. |
page | integer | Optional | Page number, from 1. |
page_ | integer | Optional | Results per page. |
ordering | string | Optional | Field to sort by. Prefix - for descending. |
export | boolean | Optional | Return the result as an export instead of a page. Default false. |
export_ | string | Optional | json or csv. |
export_ | string | Optional | How much of each record to include: basic, default or extended. |
Request
curl "https://api.deepinfo.com/v1/discovery/associated-domain-finder?domain=acme.example&page_size=25" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/discovery/associated-domain-finder",
params={"domain": "acme.example", "page_size": 25},
headers={"apikey": "YOUR_API_KEY"},
)
data = r.json()
print("applied:", data["applied_association_parameters"])
for d in data["results"]:
print(d["punycode"])const r = await fetch(
'https://api.deepinfo.com/v1/discovery/associated-domain-finder?domain=acme.example&page_size=25',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const data = await r.json()
console.log(data.applied_association_parameters, data.results.map((d) => d.punycode))Response
{
"page": 1,
"page_size": 25,
"result_count": 3,
"results": [
{
"punycode": "acme-group.example",
"unicode": "acme-group.example",
"is_idn": false,
"domain": {
"whois": {
"create_date": "2014-02-11T09:15:11Z",
"registrar": "…",
"registrant": { "organization": "…", "email": "…" }
}
}
},
{
"punycode": "acme-labs.example",
"unicode": "acme-labs.example",
"is_idn": false
},
{
"punycode": "acme-retail.example",
"unicode": "acme-retail.example",
"is_idn": false
}
],
"domain": "acme.example",
"requested_association_parameters": [
"whois_registrant_email",
"whois_registrant_email_apex_normalized"
],
"applied_association_parameters": [
"whois_registrant_email",
"whois_registrant_email_apex_normalized"
]
}From One Seed to a Reviewed List.
-
01
Seed
Start from a domain you know belongs to the organization, or from the suspicious one in front of you.
-
02
Choose signals
Ownership signals for a portfolio. Infrastructure signals when the seed hides behind WHOIS privacy.
strictwhen a shared provider makes one signal too broad. -
03
Review
Each result is a full domain record. Check registrar, dates, DNS and certificate before a domain goes on a list.
-
04
Pivot again
Run the next hop from the domains you keep, or add them to EASM as seeds for continuous discovery.
Where a Portfolio View Changes the Answer.
M&A Due Diligence
Start from the target’s main domain and list what else its registrant and infrastructure hold, beyond what the data room names.
Subsidiary Oversight
Find group-company domains registered by one team or served from shared mail and DNS servers.
Threat Hunting
From one confirmed malicious domain, list the others that share its registrant details or hosting.
Attack Surface Management
Feed domains your inventory missed back into discovery, with the signal that tied each one to you.
See This Data at Work in the Platform
This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs.
Questions About Associated Domain Finder API
Does it find look-alike domains?
No. Associations are shared attributes, not similar names. For typos and swapped letters, use fuzzy in Domain Search; Brand Risk Protection runs exact, fuzzy and confusable-character matching against your brands continuously.
What if the seed uses WHOIS privacy?
Registrant signals then have nothing to match, and applied_ comes back without them. Choose name servers, IP, mail servers or SSL organization instead.
Why is a result list sometimes very large?
Large DNS, hosting and mail providers are shared by many unrelated domains, so on their own those signals say little about ownership. Combine one with a registrant signal and set strict=true.
How is the Associated Domain Finder priced?
As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.
Can analysts run this pivot without writing code?
Yes. Deep Search & Insights runs Associated Domains and the other pivots in the Deepinfo Platform. See Domain Search.
Map the Portfolio Behind a Domain.
Bring a seed your team is working on, one of yours or a suspicious one. We set up access and run the pivots with you on a short call.