# Contains Any: Phishing-Style Keywords

contains_any takes a list and matches when the value contains at least one of its strings, anywhere: here domain names with login, verify or secure in them.

Source: https://docs.deepinfo.com/reference/discovery/domain-search/examples/contains-any-phishing-style-keywords/

Last updated: 2026-09-26

---
`POST https://api.deepinfo.com/v1/discovery/domain-search?page_size=25`

Example 6 of 9 in **Combinations › Operators** · [Domain Search Examples](/reference/discovery/domain-search/examples/) · endpoint: [Domain Search](/reference/discovery/domain-search/)

Tags: `field` `domain.name` · `operator` `contains_any` · `logic` `must`

`contains_any` takes a list and matches when the value contains at least one of its strings, anywhere: here domain names with `login`, `verify` or `secure` in them.

It works on `domain.name`, `subdomain` and `name.latinized`. For whole detected words, filter `domain.name.keywords` with `in` instead.

## Request

| Parameter | In | Value |
|---|---|---|
| `page_size` | query | `25` |
| `filters.must[0].name` | body | `domain.name` |
| `filters.must[0].type` | body | `contains_any` |
| `filters.must[0].value` | body | `["login","verify","secure"]` |

```bash
curl -X POST 'https://api.deepinfo.com/v1/discovery/domain-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "domain.name",
        "type": "contains_any",
        "value": [
          "login",
          "verify",
          "secure"
        ]
      }
    ]
  }
}'
```

## Response

### 200 · OK

> Shortened for this page: results: 3 of 25 shown

`Content-Type: application/json` · `ratelimit-limit: 1000` · `ratelimit-remaining: 999` · `ratelimit-reset: 1` · `x-ratelimit-limit-hour: 100000` · `x-ratelimit-limit-minute: 10000` · `x-ratelimit-limit-second: 1000` · `x-ratelimit-remaining-hour: 99641` · `x-ratelimit-remaining-minute: 9988` · `x-ratelimit-remaining-second: 999` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a`

```json
{
  "page": 1,
  "page_size": 25,
  "result_count": 1638048,
  "results": [
    {
      "punycode": "fedramptest.secureverifylogin.com",
      "unicode": "fedramptest.secureverifylogin.com",
      "is_idn": false,
      "subdomain": {
        "punycode": "fedramptest",
        "unicode": "fedramptest",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 11
      },
      "subdomain_last": {
        "punycode": "fedramptest",
        "unicode": "fedramptest",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 11
      },
      "subdomain_root": {
        "punycode": "fedramptest",
        "unicode": "fedramptest",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 11
      },
      "name": {
        "punycode": "fedramptest.secureverifylogin",
        "unicode": "fedramptest.secureverifylogin",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 28,
        "lang": "en",
        "keywords": [
          "fed",
          "ramp",
          "test",
          "secure",
          "verify",
          "login"
        ],
        "keyword_count": 6,
        "latinized": [],
        "contains_confusable": false
      },
      "domain": {
        "punycode": "secureverifylogin.com",
        "unicode": "secureverifylogin.com",
        "is_idn": false,
        "name": {
          "punycode": "secureverifylogin",
          "unicode": "secureverifylogin",
          "is_idn": false,
          "contains_letter": true,
          "contains_number": false,
          "contains_hyphen": false,
          "length": 17,
          "lang": "en",
          "keywords": [
            "secure",
            "verify",
            "login"
          ],
          "keyword_count": 3
        },
        "extension": {
          "punycode": "com",
          "unicode": "com",
          "is_idn": false
        },
        "extension_root": {
          "punycode": "com",
          "unicode": "com",
          "is_idn": false
        },
        "extension_sub": null,
        "extension_type": 1,
        "reserved": null,
        "premium": null,
        "registered": true,
        "whois": {
          "create_date": "2024-04-16T16:18:21Z",
          "update_date": "2025-03-12T23:16:38Z",
          "expiry_date": "2026-04-16T16:18:21Z",
          "registrar": "amazon registrar, inc.",
          "registrant": {
            "name": "REDACTED FOR PRIVACY",
            "organization": "REDACTED FOR PRIVACY",
            "street": "REDACTED FOR PRIVACY",
            "city": "hayes",
            "state": "middlesex",
            "postal_code": "REDACTED FOR PRIVACY",
            "country": "gb",
            "phone": "REDACTED FOR PRIVACY",
            "email": "REDACTED FOR PRIVACY"
          },
          "name_servers": [
            "ns-1221.awsdns-24.org",
            "ns-2028.awsdns-61.co.uk",
            "ns-448.awsdns-56.com",
            "ns-912.awsdns-50.net"
          ],
          "domain_status": [
            "ok"
          ],
          "whois_server": "whois.registrar.amazon.com",
          "check_date": "2025-03-18T12:08:02Z"
        },
        "whois_normalized": {
          "registrant": {
            "organization": "REDACTED FOR PRIVACY",
            "phone": "REDACTED FOR PRIVACY",
            "email": "REDACTED FOR PRIVACY",
            "email_fqdn_apex": "REDACTED FOR PRIVACY",
            "email_domain_apex": "REDACTED FOR PRIVACY"
          }
        },
        "whois_last_check_date": "2025-03-18T12:08:02Z",
        "whois_create_date_historical": null,
        "whois_last_change_date": "2025-03-18T12:08:48Z",
        "whois_registrant_email_historical": null,
        "whois_privacy_enabled": true,
        "dns": {
          "a": {
            "update_date": "2025-05-26T13:31:16Z",
            "ip_addresses": []
          }
        },
        "dns_last_change_date": "2025-02-12T19:42:41Z",
        "ip_history": null,
        "ssl": null,
        "ssl_last_change_date": null
      },
      "type": 2,
      "subdomain_level_count": 1,
      "dns": {
        "a": {
          "update_date": "2025-05-30T00:15:24Z",
          "ip_addresses": [
            "54.175.166.22"
          ]
        },
        "aaaa": {
          "update_date": "2025-05-30T00:15:24Z",
          "ip_addresses": []
        },
        "ns": {
          "update_date": "2025-05-30T00:15:24Z",
          "name_servers": []
        },
        "mx": {
          "update_date": "2025-05-30T00:15:24Z",
          "mail_servers": []
        },
        "soa": {
          "update_date": "2025-05-30T00:15:24Z",
          "mnames": [],
          "rnames": [],
          "rname_emails": []
        },
        "txt": {
          "update_date": "2025-05-30T00:15:24Z",
          "values": []
        },
        "cname": {
          "update_date": "2025-05-30T00:15:24Z",
          "values": []
        },
        "others": []
      },
      "dns_last_change_date": "2025-05-30T00:15:30Z",
      "ip_history": [
        "54.175.166.22"
      ],
      "ssl": null,
      "ssl_last_change_date": null,
      "webdata": {
        "connection_status": "refused",
        "html": null,
        "http": null
      }
    },
    {
      "punycode": "rustore.verifyloginsecure.info",
      "unicode": "rustore.verifyloginsecure.info",
      "is_idn": false,
      "subdomain": {
        "punycode": "rustore",
        "unicode": "rustore",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "subdomain_last": {
        "punycode": "rustore",
        "unicode": "rustore",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "subdomain_root": {
        "punycode": "rustore",
        "unicode": "rustore",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "name": {
        "punycode": "rustore.verifyloginsecure",
        "unicode": "rustore.verifyloginsecure",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 24,
        "lang": "en",
        "keywords": [
          "ru",
          "store",
          "verify",
          "login",
          "secure"
        ],
        "keyword_count": 5,
        "latinized": [],
        "contains_confusable": false
      },
      "domain": {
        "punycode": "verifyloginsecure.info",
        "unicode": "verifyloginsecure.info",
        "is_idn": false,
        "name": {
          "punycode": "verifyloginsecure",
          "unicode": "verifyloginsecure",
          "is_idn": false,
          "contains_letter": true,
          "contains_number": false,
          "contains_hyphen": false,
          "length": 17,
          "lang": "en",
          "keywords": [
            "verify",
            "login",
            "secure"
          ],
          "keyword_count": 3
        },
        "extension": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_root": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_sub": null,
        "extension_type": 1,
        "reserved": null,
        "premium": null,
        "registered": true,
        "whois": {
          "create_date": "2025-11-05T15:48:49Z",
          "update_date": "2025-11-10T15:49:09Z",
          "expiry_date": "2026-11-05T15:48:49Z",
          "registrar": "dynadot inc",
          "registrant": {
            "name": null,
            "organization": null,
            "street": null,
            "city": null,
            "state": null,
            "postal_code": null,
            "country": null,
            "phone": null,
            "email": null
          },
          "name_servers": [
            "ns1.dyna-ns.net",
            "ns2.dyna-ns.net"
          ],
          "domain_status": [
            "clienttransferprohibited"
          ],
          "whois_server": null,
          "check_date": "2026-07-23T19:39:54Z"
        },
        "whois_normalized": {
          "registrant": null
        },
        "whois_last_check_date": "2026-07-23T19:39:54Z",
        "whois_create_date_historical": null,
        "whois_last_change_date": "2026-01-16T05:06:16Z",
        "whois_registrant_email_historical": null,
        "whois_privacy_enabled": null,
        "dns": {
          "a": {
            "update_date": "2026-08-02T05:59:47Z",
            "ip_addresses": [
              "185.53.179.128"
            ]
          }
        },
        "dns_last_change_date": "2026-08-02T06:00:12Z",
        "ip_history": null,
        "ssl": null,
        "ssl_last_change_date": "2026-02-02T11:24:18Z"
      },
      "type": 2,
      "subdomain_level_count": 1,
      "dns": {
        "a": {
          "update_date": "2026-08-16T11:48:18Z",
          "ip_addresses": [
            "185.53.179.128"
          ]
        },
        "aaaa": {
          "update_date": "2026-08-16T11:48:18Z",
          "ip_addresses": []
        },
        "ns": {
          "update_date": "2026-08-16T11:48:18Z",
          "name_servers": []
        },
        "mx": {
          "update_date": "2026-08-16T11:48:18Z",
          "mail_servers": []
        },
        "soa": {
          "update_date": "2026-08-16T11:48:18Z",
          "mnames": [],
          "rnames": [],
          "rname_emails": []
        },
        "txt": {
          "update_date": "2026-08-16T11:48:18Z",
          "values": []
        },
        "cname": {
          "update_date": "2026-08-16T11:48:18Z",
          "values": []
        },
        "others": []
      },
      "dns_last_change_date": "2026-08-18T03:30:37Z",
      "ip_history": [
        "185.53.179.128",
        "185.53.179.146"
      ],
      "ssl": null,
      "ssl_last_change_date": null,
      "webdata": {
        "connection_status": "timeout",
        "html": null,
        "http": null
      }
    },
    {
      "punycode": "www.sitemap.verifyloginsecure.info",
      "unicode": "www.sitemap.verifyloginsecure.info",
      "is_idn": false,
      "subdomain": {
        "punycode": "www.sitemap",
        "unicode": "www.sitemap",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 10
      },
      "subdomain_last": {
        "punycode": "www",
        "unicode": "www",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 3
      },
      "subdomain_root": {
        "punycode": "sitemap",
        "unicode": "sitemap",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "name": {
        "punycode": "www.sitemap.verifyloginsecure",
        "unicode": "www.sitemap.verifyloginsecure",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 27,
        "lang": "de",
        "keywords": [
          "www",
          "sitemap",
          "verify",
          "login",
          "secure"
        ],
        "keyword_count": 5,
        "latinized": [],
        "contains_confusable": false
      },
      "domain": {
        "punycode": "verifyloginsecure.info",
        "unicode": "verifyloginsecure.info",
        "is_idn": false,
        "name": {
          "punycode": "verifyloginsecure",
          "unicode": "verifyloginsecure",
          "is_idn": false,
          "contains_letter": true,
          "contains_number": false,
          "contains_hyphen": false,
          "length": 17,
          "lang": "en",
          "keywords": [
            "verify",
            "login",
            "secure"
          ],
          "keyword_count": 3
        },
        "extension": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_root": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_sub": null,
        "extension_type": 1,
        "reserved": null,
        "premium": null,
        "registered": true,
        "whois": {
          "create_date": "2025-11-05T15:48:49Z",
          "update_date": "2025-11-10T15:49:09Z",
          "expiry_date": "2026-11-05T15:48:49Z",
          "registrar": "dynadot inc",
          "registrant": {
            "name": null,
            "organization": null,
            "street": null,
            "city": null,
            "state": null,
            "postal_code": null,
            "country": null,
            "phone": null,
            "email": null
          },
          "name_servers": [
            "ns1.dyna-ns.net",
            "ns2.dyna-ns.net"
          ],
          "domain_status": [
            "clienttransferprohibited"
          ],
          "whois_server": null,
          "check_date": "2026-04-23T20:24:41Z"
        },
        "whois_normalized": {
          "registrant": null
        },
        "whois_last_check_date": "2026-04-23T20:24:41Z",
        "whois_create_date_historical": null,
        "whois_last_change_date": "2026-01-16T05:06:16Z",
        "whois_registrant_email_historical": null,
        "whois_privacy_enabled": null,
        "dns": {
          "a": {
            "update_date": "2026-06-16T12:46:28Z",
            "ip_addresses": [
              "185.53.179.146"
            ]
          }
        },
        "dns_last_change_date": "2026-05-27T09:08:28Z",
        "ip_history": null,
        "ssl": null,
        "ssl_last_change_date": "2026-02-02T11:24:18Z"
      },
      "type": 2,
      "subdomain_level_count": 2,
      "dns": {
        "a": {
          "update_date": "2026-06-17T15:09:50Z",
          "ip_addresses": [
            "185.53.179.146"
          ]
        },
        "aaaa": {
          "update_date": "2026-06-17T15:09:50Z",
          "ip_addresses": []
        },
        "ns": {
          "update_date": "2026-06-17T15:09:50Z",
          "name_servers": []
        },
        "mx": {
          "update_date": "2026-06-17T15:09:50Z",
          "mail_servers": []
        },
        "soa": {
          "update_date": "2026-06-17T15:09:50Z",
          "mnames": [],
          "rnames": [],
          "rname_emails": []
        },
        "txt": {
          "update_date": "2026-06-17T15:09:50Z",
          "values": []
        },
        "cname": {
          "update_date": "2026-06-17T15:09:50Z",
          "values": []
        },
        "others": []
      },
      "dns_last_change_date": "2026-06-17T15:11:12Z",
      "ip_history": [
        "199.59.243.228",
        "185.53.179.128",
        "185.53.179.146"
      ],
      "ssl": null,
      "ssl_last_change_date": null,
      "webdata": {
        "connection_status": "success",
        "html": {
          "source_code_hash": "b4fd6b438856badbf4217ea0aff2ed116a878c16ed67015153a470f1cec5cecf"
        },
        "http": {
          "status_code_first": 200,
          "status_code_last": 200,
          "redirection_history": [
            {
              "url": "http://www.sitemap.verifyloginsecure.info/",
              "status_code": 200
            }
          ],
          "external_redirection": null,
          "final_url": "http://www.sitemap.verifyloginsecure.info/",
          "final_fqdn": "www.sitemap.verifyloginsecure.info",
          "final_domain": "verifyloginsecure.info",
          "headers": {
            "others": [
              {
                "name": "date",
                "value": "Tue, 06 Jan 2026 18:32:43 GMT"
              },
              {
                "name": "content_length",
                "value": "1098"
              },
              {
                "name": "x_request_id",
                "value": "3d92db69-be7e-413e-a0c1-181e3cf3329b"
              },
              {
                "name": "accept_ch",
                "value": "sec-ch-prefers-color-scheme"
              },
              {
                "name": "critical_ch",
                "value": "sec-ch-prefers-color-scheme"
              },
              {
                "name": "vary",
                "value": "sec-ch-prefers-color-scheme"
              },
              {
                "name": "x_adblock_key",
                "value": "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_mxGv42ZaiexApg9N30swRchq63kNgMNkPM5ODZG+ELjYTtw5UucoMm1NcJRT7QNLfdqmLK26hN1XYxPsNzDfhA=="
              }
            ],
            "access_control_allow_headers": null,
            "access_control_allow_methods": null,
            "access_control_allow_origin": null,
            "cache_control": "no-store, max-age=0",
            "clear_site_data": null,
            "content_encoding": null,
            "content_security_policy": null,
            "content_type": "text/html; charset=utf-8",
            "cross_origin_embedder_policy": null,
            "cross_origin_opener_policy": null,
            "cross_origin_resource_policy": null,
            "expect_ct": null,
            "feature_policy": null,
            "last_modified": null,
            "permission_policy": null,
            "referrer_policy": null,
            "server": null,
            "set_cookie": "parking_session=<value>; expires=Tue, 06 Jan 2026 18:47:44 GMT; path=/",
            "strict_transport_security": null,
            "x_content_type_options": null,
            "x_download_options": null,
            "x_frame_options": null,
            "x_permitted_cross_domain_policies": null,
            "x_powered_by": null,
            "x_xss_protection": null
          },
          "cookies": [
            {
              "name": "parking_session",
              "value": "<value>"
            }
          ]
        }
      }
    }
  ]
}
```

## Related Examples

- [In: One of Several Extensions](/reference/discovery/domain-search/examples/in-one-of-several-extensions/)
- [Contains All: Every Keyword Present](/reference/discovery/domain-search/examples/contains-all-every-keyword-present/)
- [Ends With: Names Ending in a Word](/reference/discovery/domain-search/examples/endswith-names-ending-in-a-word/)
- [Fuzzy: Names Close to a Brand](/reference/discovery/domain-search/examples/fuzzy-names-close-to-a-brand/)
- [Wildcard: Names Containing a Word](/reference/discovery/domain-search/examples/wildcard-names-containing-a-word/)
- [Look-Alikes Excluding the Real Domain](/reference/discovery/domain-search/examples/look-alikes-excluding-the-real-domain/)
