Instant Lookups

Check Any Domain, IP or URL as It Is Now.

Q: Are live lookups served from a cache?

No. The /lookup/ endpoints query the target, or its registry, at request time and stamp the answer with check_date. For stored observations, use DNS History, WHOIS History or Domain Search.

Triage and incident response run on small questions: what does this name resolve to, who registered it, which certificate does it serve, which ports answer. Instant Lookups puts each question to the target, or to its registry, at the moment you ask.

WHOIS, DNS and SSL answers carry the raw response next to the parsed fields. When the current answer isn’t enough, DNS History and WHOIS History show what the record used to be.

Request demo Lookup reference Platform guide: Instant lookups

Live lookupsall returned

deepinfo.com target · queried at request time

Domain WHOISGET /lookup/whois

godaddy online services cayman islands ltd. · created 2001-06-05
DNSGET /lookup/dns

A 104.26.10.21 · 104.26.11.21 · MX aspmx.l.google.com
IP WHOISGET /lookup/ip-whois

asn · network · entities (fields in the response)
SSLGET /lookup/ssl

WE1 · Google Trust Services · to 2026-11-20 · valid_chain true

check_date 2026-09-22
Port ScanPOST /lookup/port-scan

80/tcp open · 443/tcp open
TechnologyGET /lookup/technology

Cloudflare · Google Font API
ScreenshotGET /lookup/screenshot

screenshot_url · signed link, 7 days (fields in the response)
Web DataGET /lookup/webdata

title “Deepinfo | Continuous Threat Exposure Management Platform”

DNS History: A 104.26.10.21 · seen 2026-09-18, 2026-09-05, 2026-08-16 · 172.67.70.198
WHOIS History: records with their check dates

One Lookup for Each Question.

The /lookup/ endpoints query the target live. DNS History and WHOIS History read what Deepinfo has recorded for it.

Lookup	Endpoint	Returns
Domain WHOIS	`GET /lookup/whois`	Registrar, creation, update and expiry dates, name servers and status codes, raw and parsed
DNS	`GET /lookup/dns`	Current records for a name, several record types in one call, with the zone-file form beside the parsed values
IP WHOIS	`GET /lookup/ip-whois`	The owning network and its range, the ASN, the registry and the contact entities
SSL	`GET /lookup/ssl`	The certificate a host serves, parsed, with signature, chain and expiry verdicts
Port Scan	`POST /lookup/port-scan`	Open TCP and UDP ports and the services behind them, with optional version and OS detection
Technology	`GET /lookup/technology`	The technologies a site runs, each with category, version, confidence and a CPE name
Screenshot	`GET` or `POST /lookup/screenshot`	A browser capture of the page, as a signed link
Web Data	`GET /lookup/webdata`	Everything extracted from a loaded page, in one response
DNS History	`GET /analyze/dns-history`	Every distinct record value Deepinfo has observed for a name, with each time it was seen
WHOIS History	`GET /analyze/whois-history`	Each distinct registration record of a domain, with the dates it was seen

Each name links to that lookup’s API page. Parameters and response fields are in the Lookup reference.

A Certificate Check With a Clear Verdict.

The lookup opens a TLS connection to the host and parses the certificate it serves. If the connection fails, the answer still arrives, with the reason in connection_status: timeout, refused, reset, ssl_error, not_resolved or proxy_connection_error.

GET https://api.deepinfo.com/v1/lookup/ssl Reference

Parameter	Type		Description
`target`	string	Required	The host to connect to, for example `deepinfo.com`.
`port`	integer	Optional	The port to connect to. Default `443`.

Request

curl "https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com" \
  -H "apikey: YOUR_API_KEY"

import requests

r = requests.get(
    "https://api.deepinfo.com/v1/lookup/ssl",
    params={"target": "deepinfo.com"},
    headers={"apikey": "YOUR_API_KEY"},
)
cert = r.json()["parsed"]
print(cert["validity"]["end"], cert["signature"]["valid_chain"])

const r = await fetch(
  'https://api.deepinfo.com/v1/lookup/ssl?target=deepinfo.com',
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const { parsed } = await r.json()
console.log(parsed.validity.end, parsed.signature.valid_chain)

Response

200 OK · application/json

{
  "target": "deepinfo.com",
  "port": 443,
  "connection_status": "success",
  "parsed": {
    "subject": { "dn": "CN=deepinfo.com", "common_name": "deepinfo.com", "…": "…" },
    "issuer": {
      "dn": "CN=WE1,O=Google Trust Services,C=US",
      "common_name": "WE1",
      "organization": "Google Trust Services",
      "…": "…"
    },
    "validity": {
      "start": "2026-08-22T16:13:55Z",
      "end": "2026-11-20T17:13:40Z",
      "length": 7779585
    },
    "signature": {
      "valid": true,
      "valid_chain": true,
      "self_signed": false,
      "invalid_reason": null,
      "…": "…"
    },
    "fingerprint_sha256": "12a3374625c71344dca023d3fd679c8603b98712dc07b5489dde7fd65ad8ce50",
    "fingerprint_sha1": "…",
    "fingerprint_md5": "…",
    "has_expired": false,
    "fqdn_list": ["deepinfo.com"],
    "extensions": { "…": "key_usage, extended_key_usage, basic_constraints, …" }
  },
  "certificate": "MIIDfTCCAySgAwIBAgIR…",
  "parse_errors": [],
  "check_date": "2026-09-22T12:26:02Z"
}

Lookups That Load the Page.

These load the site itself instead of querying a record about it. Screenshot and Web Data open it in a real browser, so they see what a visitor sees.

Technology

What the Site Runs

CMS, web frameworks, JavaScript libraries, CDN, analytics and chat widgets, each with its category, its version when visible, a confidence from 0 to 100 and a CPE name. The CPE name is what links a technology to CVE records.

Technology API

Screenshot

What the Page Looks Like

A custom viewport, full-page capture, mobile emulation, JPEG or PNG, ad and cookie-banner blocking, or a single element by CSS selector. The result is a signed link that stays valid for seven days.

Screenshot API

Web Data

Everything on the Page

Title, description, Open Graph and JSON-LD, source and visible text with hashes, links, scripts, trackers, email addresses, favicons, robots.txt, response headers, cookies and the redirect chain. Add screenshot=true for a capture in the same call.

Web Data API

When the Current Answer Is Not Enough.

A live lookup tells you where a name resolves today. An investigation often needs to know where it resolved on the day something happened.

DNS History returns the distinct values Deepinfo has observed for a name, each with the times it was seen, including values that have since changed or been removed. WHOIS History does the same for registration records.

DNS History reference WHOIS History reference

curl "https://api.deepinfo.com/v1/analyze/dns-history?domain=deepinfo.com&type=A" \
  -H "apikey: YOUR_API_KEY"

{
  "fqdn": "deepinfo.com",
  "dn": "deepinfo.com",
  "subdomain": null,
  "records": [
    {
      "type": "a",
      "values": [
        {
          "value": "104.26.10.21",
          "time": ["2026-09-18T05:41:26Z", "2026-09-05T21:26:18Z", "2026-08-16T16:37:59Z"]
        },
        { "value": "172.67.70.198", "time": ["2026-09-18T05:41:26Z", "…"] },
        "…"
      ]
    }
  ]
}

What to Expect From Each Call.

Live and stored	The `/lookup/` endpoints query the target, or its registry, when you call them, and stamp the answer with `check_date`. The `/analyze/` endpoints read the history Deepinfo has recorded.
Quota	Lookups count against your plan’s quota at one unit per request. A DNS lookup that asks for several record types is still one unit.
Rate limits	Plan-dependent. The default is one request per second per key and endpoint. See rate limits.
Port Scan	TCP and UDP, port lists and ranges, `light` or `full` mode. A scan runs for at most 85 seconds. Only scan hosts you own or are authorized to test.
Screenshots	Screenshot links are pre-signed and expire after seven days. Save the image if you need it for longer.
Errors	Gateway and application errors each have a documented format, and each response carries a `deepinfo-request-id` header. See errors.

Questions About Instant Lookups

Are live lookups served from a cache?

No. The /lookup/ endpoints query the target, or its registry, at request time and stamp the answer with check_date. For stored observations, use DNS History, WHOIS History or Domain Search.

Where do WHOIS answers come from?

Domain WHOIS queries the registration record in real time and returns the raw text next to the parsed fields. IP WHOIS reads the regional internet registries for the owning network, its range and its ASN.

Why do some lookups take longer?

Technology, Screenshot and Web Data load the site itself instead of reading a record, so they take longer than a DNS or WHOIS lookup. Set your client timeouts with that in mind.

Can we scan any host?

Only hosts you own or are authorized to test. That condition applies to every Port Scan request and is stated in the Port Scan reference.

Can we run lookups in bulk?

Each call answers for one target, so bulk work means one call per target within your rate limit. When the answer is already in the index, Domain Search and the data feeds cover many domains at once.

Run the Lookups on Your Targets.

Book a demo and bring the domains, IPs and URLs from your last investigation. We run the live lookups and the history with you.

Request demo Talk to us about API access

Platform

Solutions

Data & API

Resources

Company