Domain Search Examples

POSThttps://api.deepinfo.com/v1/discovery/domain-search

Worked examples for Domain Search: one for every filter field, then combinations of operators, must / should / must_not, sorting and pagination.

Every example is a real request with the response the API returned. The body is {"filters": {"must": [...], "should": [...], "must_not": [...]}, "sort": [...]}; a filter is {"name": <field>, "type": <operator>, "value": <value>} (see Search & Filters). The field examples use the operator that fits the field best; not every field takes every operator, and the table below lists what each one accepts.

Responses are trimmed for display: results shows the first 3 records, long lists inside a record the first 10 items and very long texts the first 4,000 characters, while result_count stays the full total; each page says what was shortened. Personal data (WHOIS contact names, addresses, phone numbers and personal e-mail addresses) is redacted, and cookie values are masked (<value>). whois and whois_normalized are redacted separately, so a contact's organization can be redacted in one and shown in the other: when in doubt, it is redacted.

After the examples: Supported Operators by Field

Filters › Name & Extension

ExampleFieldOperatorSort
Look Up an Exact FQDNfqdneq
Subdomains Onlytypeeq
Internationalized FQDNs Onlyis_idneq
Latinized Form of an IDN Namename.latinizedcontains_any
Names With Confusable Charactersname.contains_confusableeq
All FQDNs Under One Domaindomaineq
Internationalized Domains Onlydomain.is_idneq
Same Name Across All Extensionsdomain.nameeq
Domain Names Containing Lettersdomain.name.contains_lettereq
Domain Names Containing Digitsdomain.name.contains_numbereq
Domain Names Containing a Hyphendomain.name.contains_hypheneq
Short Domain Names (Up to 5 Characters)domain.name.lengthlte
Domain Names in Germandomain.name.languageeq
Names Built From Two Keywordsdomain.name.keywordseq
Names With Three or More Keywordsdomain.name.keyword_countgte
Domains Under One Extensiondomain.extensioneq
Internationalized Extensions Onlydomain.extension.is_idneq
Every Extension Under .ukdomain.extension_rooteq
Second-Level Extensions Like co.ukdomain.extension_subeq
Country-Code Extensions Onlydomain.extension_typeeq

Filters › Subdomain

ExampleFieldOperatorSort
One Subdomain Across Domainssubdomaineq
Internationalized Subdomainssubdomain.is_idneq
Subdomains Containing Letterssubdomain.contains_lettereq
Subdomains Containing Digitssubdomain.contains_numbereq
Subdomains Containing a Hyphensubdomain.contains_hypheneq
Short Subdomains (Up to 3 Characters)subdomain.lengthlte
Last Subdomain Labelsubdomain_lasteq
Root Subdomain Labelsubdomain_rooteq
Deeply Nested Subdomainssubdomain_level_countgte

Filters › WHOIS

ExampleFieldOperatorSort
Domains Registered Since 2025domain.whois.create_dategte
WHOIS Records Updated Since 2026domain.whois.update_dategte
Domains Expiring by the End of 2026domain.whois.expiry_datelte
Registered Through GoDaddydomain.whois.registrareq
Registrant Name Presentdomain.whois.registrant.nameexists
Registrant Organization Is Cloudflaredomain.whois.registrant.organizationeq
Registrant Street Presentdomain.whois.registrant.streetexists
Registrants in One Citydomain.whois.registrant.cityeq
Registrants in One Statedomain.whois.registrant.stateeq
Registrant Postal Code Presentdomain.whois.registrant.postal_codeexists
Registrants in Germanydomain.whois.registrant.countryeq
Registrant Phone Presentdomain.whois.registrant.phoneexists
Registrant E-mail at a Privacy Servicedomain.whois.registrant.emailwildcard
Name Servers at Cloudflaredomain.whois.name_serverswildcard
Domains on Client Holddomain.whois.domain_statuseq
Normalized Registrant Organizationdomain.whois_normalized.registrant.organizationwildcard
Normalized Registrant Phone Presentdomain.whois_normalized.registrant.phoneexists
Normalized Registrant E-mail Presentdomain.whois_normalized.registrant.emailexists
Registrant E-mail Hostdomain.whois_normalized.registrant.email_fqdn_apexeq
Registrant E-mail Domaindomain.whois_normalized.registrant.email_domain_apexeq
First Registered Before 2001domain.whois_create_date_historicallte
WHOIS Changed Since the Start of 2026domain.whois_last_change_dategte
Past Registrant E-mails at a Privacy Servicedomain.whois_registrant_email_historicalwildcard
WHOIS Privacy Enableddomain.whois_privacy_enabledeq

Filters › DNS

ExampleFieldOperatorSort
Domain IPv4 (A) Record Pointing to an IPdomain.dns.a.ip_addresseseq
Domain IPv4 (A) Record Updated Since 2026domain.dns.a.update_dategte
Domain DNS Updated Since 2026domain.dns_update_dategte
Domain DNS Changed Since 2026domain.dns_last_change_dategte
FQDN IPv4 (A) Record Pointing to an IPdns.a.ip_addresseseq
A Record Updated Since 2026dns.a.update_dategte
AAAA Record Pointing to an IPv6 Addressdns.aaaa.ip_addresseseq
AAAA Record Updated Since 2026dns.aaaa.update_dategte
Delegated to a Name Serverdns.ns.name_serverseq
NS Record Updated Since 2026dns.ns.update_dategte
Mail Handled by Google Workspacedns.mx.mail_serverseq
MX Record Updated Since 2026dns.mx.update_dategte
SOA Primary Name Serverdns.soa.mnameseq
SOA Responsible Mailboxdns.soa.rnameseq
SOA Contact E-mail Domaindns.soa.rname_emailswildcard
SOA Record Updated Since 2026dns.soa.update_dategte
TXT Record Starting With a Verification Tokendns.txt.valuesstartswith
TXT Record Updated Since 2026dns.txt.update_dategte
CNAME Pointing to GitHub Pagesdns.cname.valueswildcard
CNAME Record Updated Since 2026dns.cname.update_dategte
Other Record Type: DNSKEYdns.others.typeeq
Other Record Values Presentdns.others.valuesexists
Other Records Updated Since 2026dns.others.update_dategte
DNS Updated Since 2026dns_update_dategte
DNS Changed Since 2026dns_last_change_dategte

Filters › IP History

ExampleFieldOperatorSort
Domain Once Resolved to an IPdomain.ip_historyeq
FQDN Once Resolved to Any of Several IPsip_historyin

Filters › SSL

ExampleFieldOperatorSort
Domain Certificate Issued Since 2026domain.ssl.validity.start_dategte
Domain Certificate Expiring by October 2026domain.ssl.validity.end_datelte
Domain Certificate Changed Since 2026domain.ssl_last_change_dategte
Certificates Covering a Namessl.fqdnseq
Certificate by SHA-256 Fingerprintssl.fingerprint.sha256eq
Certificate by SHA-1 Fingerprintssl.fingerprint.sha1eq
Certificate by MD5 Fingerprintssl.fingerprint.md5eq
Certificate Issued Since 2026ssl.validity.start_dategte
Certificate Expiring by October 2026ssl.validity.end_datelte
Certificates Valid for 90 Days or Lessssl.validity.lengthlte
Self-Signed Certificatesssl.signature.is_self_signedeq
Certificates With a Valid Signaturessl.signature.is_valideq
Certificate Signature Presentssl.signature.valueexists
Issuer Distinguished Namessl.issuer_dneq
Issuer Common Namessl.issuer.common_nameeq
Issuer Countryssl.issuer.countryeq
Issuer Statessl.issuer.stateeq
Issuer Localityssl.issuer.localityeq
Issued by Let's Encryptssl.issuer.organizationeq
Issuer Organizational Unit Presentssl.issuer.organizational_unitexists
Wildcard Certificates by Subject DNssl.subject_dnstartswith
Subject Common Namessl.subject.common_nameeq
Subject Countryssl.subject.countryeq
Subject Statessl.subject.stateeq
Subject Localityssl.subject.localityeq
Subject Organizationssl.subject.organizationeq
Subject Organizational Unit Presentssl.subject.organizational_unitexists
Subject Alternative Namesssl.extensions.subject_alt_name.dns_namesin
Certificate Changed Since 2026ssl_last_change_dategte

Filters › Webdata & HTTP

ExampleFieldOperatorSort
Web URL Starting With https://webdata.urlstartswith
Web Connection Failed With an SSL Errorwebdata.connection_statuseq
Pages With an Empty HTML Bodywebdata.html.source_code_hasheq
First Response Is a Permanent Redirectwebdata.http.status_code_firsteq
Final Response Is a Server Errorwebdata.http.status_code_lastgte
Redirect Chain Through Plain HTTPwebdata.http.redirection_history.urlstartswith
Redirect Chain With a 302webdata.http.redirection_history.status_codeeq
Redirects to Another Sitewebdata.http.external_redirectioneq
Final URLwebdata.http.final_urleq
Final FQDNwebdata.http.final_fqdneq
Final Domainwebdata.http.final_domaineq
Other Header Namewebdata.http.headers.others.nameeq
Other Header Valuewebdata.http.headers.others.valuewildcard
Access-Control-Allow-Headers Presentwebdata.http.headers.access_control_allow_headersexists
Access-Control-Allow-Methods Presentwebdata.http.headers.access_control_allow_methodsexists
CORS Open to Any Originwebdata.http.headers.access_control_allow_origineq
Cache-Control With a Max Agewebdata.http.headers.cache_controlstartswith
Clear-Site-Data Presentwebdata.http.headers.clear_site_dataexists
Compressed With Gzipwebdata.http.headers.content_encodingeq
CSP Allowing Unsafe Inline Codewebdata.http.headers.content_security_policywildcard
HTML Content Typewebdata.http.headers.content_typestartswith
Cross-Origin-Embedder-Policywebdata.http.headers.cross_origin_embedder_policyeq
Cross-Origin-Opener-Policywebdata.http.headers.cross_origin_opener_policyeq
Cross-Origin-Resource-Policywebdata.http.headers.cross_origin_resource_policyeq
Expect-CT Presentwebdata.http.headers.expect_ctexists
Feature-Policy Presentwebdata.http.headers.feature_policyexists
Last-Modified Presentwebdata.http.headers.last_modifiedexists
Permission Policy Presentwebdata.http.headers.permission_policyexists
Referrer-Policywebdata.http.headers.referrer_policyeq
Server Headerwebdata.http.headers.servereq
Sets a PHP Session Cookiewebdata.http.headers.set_cookiestartswith
HSTS With Preloadwebdata.http.headers.strict_transport_securitywildcard
X-Content-Type-Optionswebdata.http.headers.x_content_type_optionseq
X-Download-Optionswebdata.http.headers.x_download_optionseq
X-Frame-Optionswebdata.http.headers.x_frame_optionsin
X-Permitted-Cross-Domain-Policieswebdata.http.headers.x_permitted_cross_domain_policieseq
Powered by PHPwebdata.http.headers.x_powered_bystartswith
X-XSS-Protectionwebdata.http.headers.x_xss_protectioneq
Cookie Namewebdata.http.cookies.nameeq
Cookie Value Presentwebdata.http.cookies.valueexists

Combinations › Operators

One example for each operator, on a field where it is the natural choice.

ExampleFieldOperatorSort
Wildcard: Names Containing a Worddomain.namewildcard
Fuzzy: Names Close to a Branddomain.namefuzzy
Starts With: Login Hostsfqdnstartswith
Ends With: Names Ending in a Worddomain.nameendswith
In: One of Several Extensionsdomain.extension
domain.name		in
eq
Contains Any: Phishing-Style Keywordsdomain.namecontains_any
Contains All: Every Keyword Presentdomain.namecontains_all
Range: Name Length Between 3 and 4domain.name.length
domain.extension		gte
lte
eq
Exists False: Domains Without a Registrardomain.whois.registrar
type		exists
eq

Combinations › Must, Should and Must Not

must filters all have to match (AND), at least one should filter has to match (OR), and no must_not filter may match (NOT).

ExampleFieldOperatorSort
Look-Alikes Excluding the Real Domaindomain.name
domain		fuzzy
eq
Should: Either of Two Registrarsdomain.whois.registrareq
Must and Should Togetherdomain.extension
dns.ns.name_servers		eq
wildcard
Must Not: Registrable Domains Outside .comtype
domain.name
domain.extension		eq
All Three: New Shops Without WHOIS Privacydomain.whois.create_date
domain.name.keywords
domain.whois_privacy_enabled		gte
eq

Combinations › Sorting

sort is a list of {field, order}; order is asc or desc. One example for each sortable field.

ExampleFieldOperatorSort
Sort by Name (A to Z)domain.extension
type		eqpunycode
Sort by Extensiondomain.name
type		eqdomain.extension.punycode
Newest Registrations Firstdomain.whois.create_date
type		gte
eq		domain.whois.create_date
Soonest to Expire Firstdomain.whois.expiry_date
domain.extension		gte
eq		domain.whois.expiry_date
Most Recently Updated WHOIS Firstdomain.whois.registrareqdomain.whois.update_date
Latest WHOIS Changes Firstdomain.extension
type		eqdomain.whois_last_change_date
Latest DNS Changes Firstdns.ns.name_serverswildcarddns_last_change_date
Latest Certificate Changes Firstssl.issuer.organizationeqssl_last_change_date
Sort by Two Fieldsdomain.nameeqdomain.extension.punycode
domain.whois.create_date

Combinations › Pagination

page and page_size are query parameters. result_count is always the full total; results page up to 10,000.

ExampleFieldOperatorSort
Second Page of Resultsdomain.extension
type		eq
Larger Pages (100 Results)domain.extension
type		eq
Last Reachable Page (10,000 Results)domain.extension
type		eq

Combinations › Investigations

Filters combined the way they are used in practice.

ExampleFieldOperatorSort
Expiring Soon With WHOIS Privacydomain.whois.expiry_date
domain.whois_privacy_enabled		lte
eq
Self-Signed or Invalid Certificatesssl.signature.is_self_signed
ssl.signature.is_valid		eq
Live Sites Without HSTSwebdata.connection_status
webdata.http.headers.strict_transport_security		eq
exists
Missing Clickjacking Protectionwebdata.connection_status
webdata.http.headers.x_frame_options
webdata.http.headers.content_security_policy		eq
exists
New Look-Alikes With Mail Serversdomain.name
domain.whois.create_date
dns.mx.mail_servers
domain		fuzzy
gte
exists
eq
Wildcard Certificates From Let's Encryptssl.subject_dn
ssl.issuer.organization		startswith
eq
Confusable IDN Domainsis_idn
name.contains_confusable		eq
Redirects Away to Another Sitewebdata.http.external_redirection
webdata.http.status_code_first		eq
in

Supported Operators by Field

Not every field takes every operator: a filter with an operator its field does not support is answered with HTTP 400 ("Field '…' does not support '…' query"). Verified against the live API on 2026-09-23.

Legend: wc wildcard · fz fuzzy · sw startswith · ew endswith · any contains_any · all contains_all · ex exists; eq, in, lte and gte are the operators' own names.

Family Field Operators
Name & Extension domain.name eq in wc fz sw ew any all ex
name.latinized eq in wc fz sw any all ex
fqdn eq in wc fz sw ex
domain eq in wc fz sw ex
domain.name.language eq in wc fz sw ex
domain.name.keywords eq in wc fz sw ex
domain.extension eq in wc fz sw ex
domain.extension_root eq in wc fz sw ex
domain.extension_sub eq in wc fz sw ex
type eq in lte gte ex
domain.name.length eq in lte gte ex
domain.name.keyword_count eq in lte gte ex
domain.extension_type eq in lte gte ex
is_idn eq in ex
name.contains_confusable eq in ex
domain.is_idn eq in ex
domain.name.contains_letter eq in ex
domain.name.contains_number eq in ex
domain.name.contains_hyphen eq in ex
domain.extension.is_idn eq in ex
Subdomain subdomain eq in wc fz sw ew any all ex
subdomain_last eq in wc fz sw ex
subdomain_root eq in wc fz sw ex
subdomain.length eq in lte gte ex
subdomain_level_count eq in lte gte ex
subdomain.is_idn eq in ex
subdomain.contains_letter eq in ex
subdomain.contains_number eq in ex
subdomain.contains_hyphen eq in ex
WHOIS domain.whois.registrar eq in wc fz sw ex
domain.whois.registrant.name eq in wc fz sw ex
domain.whois.registrant.organization eq in wc fz sw ex
domain.whois.registrant.street eq in wc fz sw ex
domain.whois.registrant.city eq in wc fz sw ex
domain.whois.registrant.state eq in wc fz sw ex
domain.whois.registrant.postal_code eq in wc fz sw ex
domain.whois.registrant.country eq in wc fz sw ex
domain.whois.registrant.phone eq in wc fz sw ex
domain.whois.registrant.email eq in wc fz sw ex
domain.whois.name_servers eq in wc fz sw ex
domain.whois.domain_status eq in wc fz sw ex
domain.whois_normalized.registrant.organization eq in wc fz sw ex
domain.whois_normalized.registrant.phone eq in wc fz sw ex
domain.whois_normalized.registrant.email eq in wc fz sw ex
domain.whois_normalized.registrant.email_fqdn_apex eq in wc fz sw ex
domain.whois_normalized.registrant.email_domain_apex eq in wc fz sw ex
domain.whois_registrant_email_historical eq in wc fz sw ex
domain.whois.create_date eq in lte gte ex
domain.whois.update_date eq in lte gte ex
domain.whois.expiry_date eq in lte gte ex
domain.whois_create_date_historical eq in lte gte ex
domain.whois_last_change_date eq in lte gte ex
domain.whois_privacy_enabled eq in ex
DNS domain.dns.a.ip_addresses eq in wc fz sw ex
dns.a.ip_addresses eq in wc fz sw ex
dns.aaaa.ip_addresses eq in wc fz sw ex
dns.ns.name_servers eq in wc fz sw ex
dns.mx.mail_servers eq in wc fz sw ex
dns.soa.mnames eq in wc fz sw ex
dns.soa.rnames eq in wc fz sw ex
dns.soa.rname_emails eq in wc fz sw ex
dns.txt.values eq in wc fz sw ex
dns.cname.values eq in wc fz sw ex
dns.others.type eq in wc fz sw ex
dns.others.values eq in wc fz sw ex
domain.dns.a.update_date eq in lte gte ex
domain.dns_update_date eq in lte gte ex
domain.dns_last_change_date eq in lte gte ex
dns.a.update_date eq in lte gte ex
dns.aaaa.update_date eq in lte gte ex
dns.ns.update_date eq in lte gte ex
dns.mx.update_date eq in lte gte ex
dns.soa.update_date eq in lte gte ex
dns.txt.update_date eq in lte gte ex
dns.cname.update_date eq in lte gte ex
dns.others.update_date eq in lte gte ex
dns_update_date eq in lte gte ex
dns_last_change_date eq in lte gte ex
IP History domain.ip_history eq in wc fz sw ex
ip_history eq in wc fz sw ex
SSL ssl.fqdns eq in wc fz sw ex
ssl.fingerprint.sha256 eq in wc fz sw ex
ssl.fingerprint.sha1 eq in wc fz sw ex
ssl.fingerprint.md5 eq in wc fz sw ex
ssl.signature.value eq in wc fz sw ex
ssl.issuer_dn eq in wc fz sw ex
ssl.issuer.common_name eq in wc fz sw ex
ssl.issuer.country eq in wc fz sw ex
ssl.issuer.state eq in wc fz sw ex
ssl.issuer.locality eq in wc fz sw ex
ssl.issuer.organization eq in wc fz sw ex
ssl.issuer.organizational_unit eq in wc fz sw ex
ssl.subject_dn eq in wc fz sw ex
ssl.subject.common_name eq in wc fz sw ex
ssl.subject.country eq in wc fz sw ex
ssl.subject.state eq in wc fz sw ex
ssl.subject.locality eq in wc fz sw ex
ssl.subject.organization eq in wc fz sw ex
ssl.subject.organizational_unit eq in wc fz sw ex
ssl.extensions.subject_alt_name.dns_names eq in wc fz sw ex
domain.ssl.validity.start_date eq in lte gte ex
domain.ssl.validity.end_date eq in lte gte ex
domain.ssl_last_change_date eq in lte gte ex
ssl.validity.start_date eq in lte gte ex
ssl.validity.end_date eq in lte gte ex
ssl.validity.length eq in lte gte ex
ssl_last_change_date eq in lte gte ex
ssl.signature.is_self_signed eq in ex
ssl.signature.is_valid eq in ex
Webdata & HTTP webdata.url eq in wc fz sw ex
webdata.connection_status eq in wc fz sw ex
webdata.html.source_code_hash eq in wc fz sw ex
webdata.http.redirection_history.url eq in wc fz sw ex
webdata.http.final_url eq in wc fz sw ex
webdata.http.final_fqdn eq in wc fz sw ex
webdata.http.final_domain eq in wc fz sw ex
webdata.http.headers.others.name eq in wc fz sw ex
webdata.http.headers.others.value eq in wc fz sw ex
webdata.http.headers.access_control_allow_headers eq in wc fz sw ex
webdata.http.headers.access_control_allow_methods eq in wc fz sw ex
webdata.http.headers.access_control_allow_origin eq in wc fz sw ex
webdata.http.headers.cache_control eq in wc fz sw ex
webdata.http.headers.clear_site_data eq in wc fz sw ex
webdata.http.headers.content_encoding eq in wc fz sw ex
webdata.http.headers.content_security_policy eq in wc fz sw ex
webdata.http.headers.content_type eq in wc fz sw ex
webdata.http.headers.cross_origin_embedder_policy eq in wc fz sw ex
webdata.http.headers.cross_origin_opener_policy eq in wc fz sw ex
webdata.http.headers.cross_origin_resource_policy eq in wc fz sw ex
webdata.http.headers.expect_ct eq in wc fz sw ex
webdata.http.headers.feature_policy eq in wc fz sw ex
webdata.http.headers.last_modified eq in wc fz sw ex
webdata.http.headers.permission_policy eq in wc fz sw ex
webdata.http.headers.referrer_policy eq in wc fz sw ex
webdata.http.headers.server eq in wc fz sw ex
webdata.http.headers.set_cookie eq in wc fz sw ex
webdata.http.headers.strict_transport_security eq in wc fz sw ex
webdata.http.headers.x_content_type_options eq in wc fz sw ex
webdata.http.headers.x_download_options eq in wc fz sw ex
webdata.http.headers.x_frame_options eq in wc fz sw ex
webdata.http.headers.x_permitted_cross_domain_policies eq in wc fz sw ex
webdata.http.headers.x_powered_by eq in wc fz sw ex
webdata.http.headers.x_xss_protection eq in wc fz sw ex
webdata.http.cookies.name eq in wc fz sw ex
webdata.http.cookies.value eq in wc fz sw ex
webdata.http.status_code_first eq in lte gte ex
webdata.http.status_code_last eq in lte gte ex
webdata.http.redirection_history.status_code eq in lte gte ex
webdata.http.external_redirection eq in ex

Reference updated