Deep Search & Insights
The Index Under Every Module, Open to Your Team.
Deep Search & Insights is Deepinfo’s own internet index, opened for direct query. This data also runs External Attack Surface Management, Cyber Threat Intelligence, Brand Risk Protection and Third-Party Risk Management.
Search domains by what they resolve to, who registered them and what they serve, pivot from one indicator to the domains that share it, or pull a CVE with EPSS and CISA KEV attached.
- The index, cut: 400M+ domains, 2B+ subdomains, 200B+ DNS records, 30B+ SSL certificates, and beside them the CVE database.
- Under every module: EASM, CTI, BRP and TPRM stand on it.
- Domain Search: domain.name fuzzy “acme” finds acmme.example and acrne.example.
- Domain Intelligence: new registrations, day by day.
- Pivots: Reverse IP from 203.0.113.24 to staging.acme.example.
- Vulnerability Search: CVE-2021-44228, CVSS 10, EPSS 0.99999, in CISA KEV.
- Vulnerability Intelligence: CVEs and CISA KEV additions, week by week.
- Instant Lookups: WHOIS, DNS, SSL and ports on the target itself, as it answers now.
- Build on it directly: API services, each search and lookup as a REST endpoint; data feeds, whole datasets as files.
The Internet Changed Again This Week.
New domains are registered daily, new CVEs are published and the list of known-exploited vulnerabilities grows. A search engine indexes pages, and a monitoring tool sees the assets you added. Questions about everything else need the index itself.
Search, Intelligence and Lookups Over One Index.
The Search capabilities return the records that match a filter, the Intelligence capabilities return counts and trends across the whole index, and Instant Lookups query one target live.
Domain Intelligence
Domains registered in the last day, week, month and year, a daily registration timeline, and the top TLDs and name keywords among new registrations.
Domain Search
Filter every domain in the index on its WHOIS, DNS, SSL and web data, or pivot from an IP, a mail server, a name server or a registrant email to the domains that share it.
Vulnerability Intelligence
CVEs published and modified in the last day, week and month, CISA KEV additions, severity by year, the spread of CVSS scores, the CWE timeline and EPSS history per CVE.
Vulnerability Search
Filter the CVE database on severity, weakness, product, EPSS and KEV, or list the vulnerabilities that affect the technologies detected on a URL.
Instant Lookups
WHOIS, DNS, IP WHOIS, SSL, port scan, technology, screenshot and web data for one target in real time, plus DNS and WHOIS history.
Query the Index Like a Database.
Domain Search filters the whole domain dataset on fields grouped by what they describe: name and extension, subdomain, WHOIS, DNS, IP history, SSL, and web data with HTTP.
Conditions combine with must, should and must_ and operators from eq and wildcard to fuzzy, gte and exists. Result sets export as JSON or CSV.
The example finds names close to a brand, registered since the start of 2026, that already have mail servers.
{
"filters": {
"must": [
{ "name": "domain.name", "type": "fuzzy", "value": "acme" },
{
"name": "domain.whois.create_date",
"type": "gte",
"value": "2026-01-01T00:00:00Z"
},
{ "name": "dns.mx.mail_servers", "type": "exists", "value": true }
],
"must_not": [
{ "name": "domain", "type": "eq", "value": "acme.example" }
]
}
}curl -X POST \
"https://api.deepinfo.com/v1/discovery/domain-search" \
-H "apikey: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d @filter.jsonOne CVE Record Holds the Whole Priority Case.
A CVSS base score describes severity in the abstract. The record DSI returns adds the exploitation evidence: an EPSS probability with its daily history, the CISA KEV entry once a CVE is known to be exploited, and the product ranges it affects.
Vulnerability Search filters on the record’s own fields, so “in CISA KEV, EPSS 0.7 or higher, newest first” is two filter conditions and a sort.
- CVSS v2, v3.0, v3.1 and v4.0 metrics
- EPSS score and percentile, with daily history
- CISA KEV entry: date added, due date, required action, known ransomware use
- CWE with CAPEC IDs and the OWASP Top 10 2021 field
- Affected products as CPE ranges
- vDeep, Deepinfo’s own CVSS scoring layer
{
"id": "CVE-2021-44228",
"published": "2021-12-10T10:15:09Z",
"cisa_exploit_add": "2021-12-10",
"cisa_action_due": "2021-12-24",
"metrics": {
"cvss_metric_v31": [
{ "type": "Primary", "cvss_data": { "version": "3.1", "base_score": 10.0, "…": "…" } }
],
"…": "cvss_metric_v40, cvss_metric_v30, cvss_metric_v2"
},
"enrichment": {
"epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
"cisa_kev": {
"vendor_project": "Apache",
"product": "Log4j2",
"date_added": "2021-12-10",
"…": "required_action, due_date, known_ransomware_campaign_use"
},
"cwe": [
{ "id": 400, "name": "Uncontrolled Resource Consumption", "capec_id": [147, 227] }
],
"cpe": ["…"],
"vdeep_metric": { "…": "…" }
}
}- How severe (base_score: 10.0)
- How likely to be exploited (epss: 0.99999)
- Known to be exploited (date_added: 2021-12-10)
- What kind of flaw (cwe)
curl "https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2021-44228" \
-H "apikey: YOUR_API_KEY"Questions About Deep Search & Insights
What is Deep Search & Insights?
Deep Search & Insights (DSI) is direct access to Deepinfo’s internet index: domains, subdomains, DNS, WHOIS, SSL, web data and vulnerabilities, with DNS and WHOIS history. It answers questions a general search engine can’t, such as which domains share this mail server, or which CVEs in CISA KEV affect this product.
What can we query through DSI?
400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates, plus a CVE database enriched with EPSS, CISA KEV, CWE and CAPEC, and dark web sources through Dark Web Search. A query can start from a domain, an IP, a mail server, a name server, a registrant email, a URL or a CVE.
How is DSI different from WHOIS tools and general OSINT search?
A WHOIS tool reads one registration record at a time, and a search engine indexes web pages, not DNS records or certificates. DSI keeps those layers for every domain in the index, with DNS and WHOIS history, and lets you search across all of them at once.
What does a typical DSI investigation look like?
Start from one indicator, such as a suspicious domain, an IP or a registrant email. Pivot to the domains that share it, open each result’s full record, check its DNS and WHOIS history, and export the set as JSON or CSV for offline work.
Is it the same data as Deepinfo’s Data & API products?
Yes. DSI opens the index for direct query in the platform, and Deepinfo API Services and Data Feeds deliver the same data as endpoints and bulk files. See Data & API.
How do we get access?
Analysts work in the Deepinfo Platform, developers call the REST API with an apikey header, and bulk consumers take Data Feeds as files. Which endpoints you can call, and your rate limits, depend on your plan. See the API reference or talk to us.
Are there limits on how much we can query?
API rate limits are set by your plan, per key and per endpoint, with a default of one request per second. Lookups also count against a plan quota, at one unit per request.
Search the Index Behind the Platform.
Query it from your tools through the API, or bring your own indicators to a demo and we’ll run the pivots live.