Domain Search Examples · Example 6 of 9 in Combinations › Operators

Contains Any: Phishing-Style Keywords

POSThttps://api.deepinfo.com/v1/discovery/domain-search

Field: domain.name
Operator: contains_any
Logic: must

contains_any takes a list and matches when the value contains at least one of its strings, anywhere: here domain names with login, verify or secure in them.

It works on domain.name, subdomain and name.latinized. For whole detected words, filter domain.name.keywords with in instead.

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/discovery/domain-search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "domain.name",
        "type": "contains_any",
        "value": [
          "login",
          "verify",
          "secure"
        ]
      }
    ]
  }
}'

Python

import requests

url = "https://api.deepinfo.com/v1/discovery/domain-search"

params = {
    "page_size": "25"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "domain.name",
                "type": "contains_any",
                "value": [
                    "login",
                    "verify",
                    "secure"
                ]
            }
        ]
    }
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/discovery/domain-search?page_size=25";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "domain.name",
          type: "contains_any",
          value: [
            "login",
            "verify",
            "secure"
          ]
        }
      ]
    }
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "domain.name",
        "type": "contains_any",
        "value": [
          "login",
          "verify",
          "secure"
        ]
      }
    ]
  }
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/discovery/domain-search?page_size=25", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "domain.name",
                    "type": "contains_any",
                    "value": [
                      "login",
                      "verify",
                      "secure"
                    ]
                  }
                ]
              }
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/discovery/domain-search?page_size=25"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "domain.name",
            "type": "contains_any",
            "value": [
              "login",
              "verify",
              "secure"
            ]
          }
        ]
      }
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/discovery/domain-search?page_size=25");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "domain.name",
        "type": "contains_any",
        "value": [
          "login",
          "verify",
          "secure"
        ]
      }
    ]
  }
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/discovery/domain-search?page_size=25',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/discovery/domain-search?page_size=25')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "domain.name",
          "type": "contains_any",
          "value": [
            "login",
            "verify",
            "secure"
          ]
        }
      ]
    }
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Shortened for this page: results: 3 of 25 shown

Response Body

{
  "page": 1,
  "page_size": 25,
  "result_count": 1638048,
  "results": [
    {
      "punycode": "fedramptest.secureverifylogin.com",
      "unicode": "fedramptest.secureverifylogin.com",
      "is_idn": false,
      "subdomain": {
        "punycode": "fedramptest",
        "unicode": "fedramptest",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 11
      },
      "subdomain_last": {
        "punycode": "fedramptest",
        "unicode": "fedramptest",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 11
      },
      "subdomain_root": {
        "punycode": "fedramptest",
        "unicode": "fedramptest",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 11
      },
      "name": {
        "punycode": "fedramptest.secureverifylogin",
        "unicode": "fedramptest.secureverifylogin",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 28,
        "lang": "en",
        "keywords": [
          "fed",
          "ramp",
          "test",
          "secure",
          "verify",
          "login"
        ],
        "keyword_count": 6,
        "latinized": [],
        "contains_confusable": false
      },
      "domain": {
        "punycode": "secureverifylogin.com",
        "unicode": "secureverifylogin.com",
        "is_idn": false,
        "name": {
          "punycode": "secureverifylogin",
          "unicode": "secureverifylogin",
          "is_idn": false,
          "contains_letter": true,
          "contains_number": false,
          "contains_hyphen": false,
          "length": 17,
          "lang": "en",
          "keywords": [
            "secure",
            "verify",
            "login"
          ],
          "keyword_count": 3
        },
        "extension": {
          "punycode": "com",
          "unicode": "com",
          "is_idn": false
        },
        "extension_root": {
          "punycode": "com",
          "unicode": "com",
          "is_idn": false
        },
        "extension_sub": null,
        "extension_type": 1,
        "reserved": null,
        "premium": null,
        "registered": true,
        "whois": {
          "create_date": "2024-04-16T16:18:21Z",
          "update_date": "2025-03-12T23:16:38Z",
          "expiry_date": "2026-04-16T16:18:21Z",
          "registrar": "amazon registrar, inc.",
          "registrant": {
            "name": "REDACTED FOR PRIVACY",
            "organization": "REDACTED FOR PRIVACY",
            "street": "REDACTED FOR PRIVACY",
            "city": "hayes",
            "state": "middlesex",
            "postal_code": "REDACTED FOR PRIVACY",
            "country": "gb",
            "phone": "REDACTED FOR PRIVACY",
            "email": "REDACTED FOR PRIVACY"
          },
          "name_servers": [
            "ns-1221.awsdns-24.org",
            "ns-2028.awsdns-61.co.uk",
            "ns-448.awsdns-56.com",
            "ns-912.awsdns-50.net"
          ],
          "domain_status": [
            "ok"
          ],
          "whois_server": "whois.registrar.amazon.com",
          "check_date": "2025-03-18T12:08:02Z"
        },
        "whois_normalized": {
          "registrant": {
            "organization": "REDACTED FOR PRIVACY",
            "phone": "REDACTED FOR PRIVACY",
            "email": "REDACTED FOR PRIVACY",
            "email_fqdn_apex": "REDACTED FOR PRIVACY",
            "email_domain_apex": "REDACTED FOR PRIVACY"
          }
        },
        "whois_last_check_date": "2025-03-18T12:08:02Z",
        "whois_create_date_historical": null,
        "whois_last_change_date": "2025-03-18T12:08:48Z",
        "whois_registrant_email_historical": null,
        "whois_privacy_enabled": true,
        "dns": {
          "a": {
            "update_date": "2025-05-26T13:31:16Z",
            "ip_addresses": []
          }
        },
        "dns_last_change_date": "2025-02-12T19:42:41Z",
        "ip_history": null,
        "ssl": null,
        "ssl_last_change_date": null
      },
      "type": 2,
      "subdomain_level_count": 1,
      "dns": {
        "a": {
          "update_date": "2025-05-30T00:15:24Z",
          "ip_addresses": [
            "54.175.166.22"
          ]
        },
        "aaaa": {
          "update_date": "2025-05-30T00:15:24Z",
          "ip_addresses": []
        },
        "ns": {
          "update_date": "2025-05-30T00:15:24Z",
          "name_servers": []
        },
        "mx": {
          "update_date": "2025-05-30T00:15:24Z",
          "mail_servers": []
        },
        "soa": {
          "update_date": "2025-05-30T00:15:24Z",
          "mnames": [],
          "rnames": [],
          "rname_emails": []
        },
        "txt": {
          "update_date": "2025-05-30T00:15:24Z",
          "values": []
        },
        "cname": {
          "update_date": "2025-05-30T00:15:24Z",
          "values": []
        },
        "others": []
      },
      "dns_last_change_date": "2025-05-30T00:15:30Z",
      "ip_history": [
        "54.175.166.22"
      ],
      "ssl": null,
      "ssl_last_change_date": null,
      "webdata": {
        "connection_status": "refused",
        "html": null,
        "http": null
      }
    },
    {
      "punycode": "rustore.verifyloginsecure.info",
      "unicode": "rustore.verifyloginsecure.info",
      "is_idn": false,
      "subdomain": {
        "punycode": "rustore",
        "unicode": "rustore",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "subdomain_last": {
        "punycode": "rustore",
        "unicode": "rustore",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "subdomain_root": {
        "punycode": "rustore",
        "unicode": "rustore",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "name": {
        "punycode": "rustore.verifyloginsecure",
        "unicode": "rustore.verifyloginsecure",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 24,
        "lang": "en",
        "keywords": [
          "ru",
          "store",
          "verify",
          "login",
          "secure"
        ],
        "keyword_count": 5,
        "latinized": [],
        "contains_confusable": false
      },
      "domain": {
        "punycode": "verifyloginsecure.info",
        "unicode": "verifyloginsecure.info",
        "is_idn": false,
        "name": {
          "punycode": "verifyloginsecure",
          "unicode": "verifyloginsecure",
          "is_idn": false,
          "contains_letter": true,
          "contains_number": false,
          "contains_hyphen": false,
          "length": 17,
          "lang": "en",
          "keywords": [
            "verify",
            "login",
            "secure"
          ],
          "keyword_count": 3
        },
        "extension": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_root": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_sub": null,
        "extension_type": 1,
        "reserved": null,
        "premium": null,
        "registered": true,
        "whois": {
          "create_date": "2025-11-05T15:48:49Z",
          "update_date": "2025-11-10T15:49:09Z",
          "expiry_date": "2026-11-05T15:48:49Z",
          "registrar": "dynadot inc",
          "registrant": {
            "name": null,
            "organization": null,
            "street": null,
            "city": null,
            "state": null,
            "postal_code": null,
            "country": null,
            "phone": null,
            "email": null
          },
          "name_servers": [
            "ns1.dyna-ns.net",
            "ns2.dyna-ns.net"
          ],
          "domain_status": [
            "clienttransferprohibited"
          ],
          "whois_server": null,
          "check_date": "2026-07-23T19:39:54Z"
        },
        "whois_normalized": {
          "registrant": null
        },
        "whois_last_check_date": "2026-07-23T19:39:54Z",
        "whois_create_date_historical": null,
        "whois_last_change_date": "2026-01-16T05:06:16Z",
        "whois_registrant_email_historical": null,
        "whois_privacy_enabled": null,
        "dns": {
          "a": {
            "update_date": "2026-08-02T05:59:47Z",
            "ip_addresses": [
              "185.53.179.128"
            ]
          }
        },
        "dns_last_change_date": "2026-08-02T06:00:12Z",
        "ip_history": null,
        "ssl": null,
        "ssl_last_change_date": "2026-02-02T11:24:18Z"
      },
      "type": 2,
      "subdomain_level_count": 1,
      "dns": {
        "a": {
          "update_date": "2026-08-16T11:48:18Z",
          "ip_addresses": [
            "185.53.179.128"
          ]
        },
        "aaaa": {
          "update_date": "2026-08-16T11:48:18Z",
          "ip_addresses": []
        },
        "ns": {
          "update_date": "2026-08-16T11:48:18Z",
          "name_servers": []
        },
        "mx": {
          "update_date": "2026-08-16T11:48:18Z",
          "mail_servers": []
        },
        "soa": {
          "update_date": "2026-08-16T11:48:18Z",
          "mnames": [],
          "rnames": [],
          "rname_emails": []
        },
        "txt": {
          "update_date": "2026-08-16T11:48:18Z",
          "values": []
        },
        "cname": {
          "update_date": "2026-08-16T11:48:18Z",
          "values": []
        },
        "others": []
      },
      "dns_last_change_date": "2026-08-18T03:30:37Z",
      "ip_history": [
        "185.53.179.128",
        "185.53.179.146"
      ],
      "ssl": null,
      "ssl_last_change_date": null,
      "webdata": {
        "connection_status": "timeout",
        "html": null,
        "http": null
      }
    },
    {
      "punycode": "www.sitemap.verifyloginsecure.info",
      "unicode": "www.sitemap.verifyloginsecure.info",
      "is_idn": false,
      "subdomain": {
        "punycode": "www.sitemap",
        "unicode": "www.sitemap",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 10
      },
      "subdomain_last": {
        "punycode": "www",
        "unicode": "www",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 3
      },
      "subdomain_root": {
        "punycode": "sitemap",
        "unicode": "sitemap",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 7
      },
      "name": {
        "punycode": "www.sitemap.verifyloginsecure",
        "unicode": "www.sitemap.verifyloginsecure",
        "is_idn": false,
        "contains_letter": true,
        "contains_number": false,
        "contains_hyphen": false,
        "length": 27,
        "lang": "de",
        "keywords": [
          "www",
          "sitemap",
          "verify",
          "login",
          "secure"
        ],
        "keyword_count": 5,
        "latinized": [],
        "contains_confusable": false
      },
      "domain": {
        "punycode": "verifyloginsecure.info",
        "unicode": "verifyloginsecure.info",
        "is_idn": false,
        "name": {
          "punycode": "verifyloginsecure",
          "unicode": "verifyloginsecure",
          "is_idn": false,
          "contains_letter": true,
          "contains_number": false,
          "contains_hyphen": false,
          "length": 17,
          "lang": "en",
          "keywords": [
            "verify",
            "login",
            "secure"
          ],
          "keyword_count": 3
        },
        "extension": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_root": {
          "punycode": "info",
          "unicode": "info",
          "is_idn": false
        },
        "extension_sub": null,
        "extension_type": 1,
        "reserved": null,
        "premium": null,
        "registered": true,
        "whois": {
          "create_date": "2025-11-05T15:48:49Z",
          "update_date": "2025-11-10T15:49:09Z",
          "expiry_date": "2026-11-05T15:48:49Z",
          "registrar": "dynadot inc",
          "registrant": {
            "name": null,
            "organization": null,
            "street": null,
            "city": null,
            "state": null,
            "postal_code": null,
            "country": null,
            "phone": null,
            "email": null
          },
          "name_servers": [
            "ns1.dyna-ns.net",
            "ns2.dyna-ns.net"
          ],
          "domain_status": [
            "clienttransferprohibited"
          ],
          "whois_server": null,
          "check_date": "2026-04-23T20:24:41Z"
        },
        "whois_normalized": {
          "registrant": null
        },
        "whois_last_check_date": "2026-04-23T20:24:41Z",
        "whois_create_date_historical": null,
        "whois_last_change_date": "2026-01-16T05:06:16Z",
        "whois_registrant_email_historical": null,
        "whois_privacy_enabled": null,
        "dns": {
          "a": {
            "update_date": "2026-06-16T12:46:28Z",
            "ip_addresses": [
              "185.53.179.146"
            ]
          }
        },
        "dns_last_change_date": "2026-05-27T09:08:28Z",
        "ip_history": null,
        "ssl": null,
        "ssl_last_change_date": "2026-02-02T11:24:18Z"
      },
      "type": 2,
      "subdomain_level_count": 2,
      "dns": {
        "a": {
          "update_date": "2026-06-17T15:09:50Z",
          "ip_addresses": [
            "185.53.179.146"
          ]
        },
        "aaaa": {
          "update_date": "2026-06-17T15:09:50Z",
          "ip_addresses": []
        },
        "ns": {
          "update_date": "2026-06-17T15:09:50Z",
          "name_servers": []
        },
        "mx": {
          "update_date": "2026-06-17T15:09:50Z",
          "mail_servers": []
        },
        "soa": {
          "update_date": "2026-06-17T15:09:50Z",
          "mnames": [],
          "rnames": [],
          "rname_emails": []
        },
        "txt": {
          "update_date": "2026-06-17T15:09:50Z",
          "values": []
        },
        "cname": {
          "update_date": "2026-06-17T15:09:50Z",
          "values": []
        },
        "others": []
      },
      "dns_last_change_date": "2026-06-17T15:11:12Z",
      "ip_history": [
        "199.59.243.228",
        "185.53.179.128",
        "185.53.179.146"
      ],
      "ssl": null,
      "ssl_last_change_date": null,
      "webdata": {
        "connection_status": "success",
        "html": {
          "source_code_hash": "b4fd6b438856badbf4217ea0aff2ed116a878c16ed67015153a470f1cec5cecf"
        },
        "http": {
          "status_code_first": 200,
          "status_code_last": 200,
          "redirection_history": [
            {
              "url": "http://www.sitemap.verifyloginsecure.info/",
              "status_code": 200
            }
          ],
          "external_redirection": null,
          "final_url": "http://www.sitemap.verifyloginsecure.info/",
          "final_fqdn": "www.sitemap.verifyloginsecure.info",
          "final_domain": "verifyloginsecure.info",
          "headers": {
            "others": [
              {
                "name": "date",
                "value": "Tue, 06 Jan 2026 18:32:43 GMT"
              },
              {
                "name": "content_length",
                "value": "1098"
              },
              {
                "name": "x_request_id",
                "value": "3d92db69-be7e-413e-a0c1-181e3cf3329b"
              },
              {
                "name": "accept_ch",
                "value": "sec-ch-prefers-color-scheme"
              },
              {
                "name": "critical_ch",
                "value": "sec-ch-prefers-color-scheme"
              },
              {
                "name": "vary",
                "value": "sec-ch-prefers-color-scheme"
              },
              {
                "name": "x_adblock_key",
                "value": "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_mxGv42ZaiexApg9N30swRchq63kNgMNkPM5ODZG+ELjYTtw5UucoMm1NcJRT7QNLfdqmLK26hN1XYxPsNzDfhA=="
              }
            ],
            "access_control_allow_headers": null,
            "access_control_allow_methods": null,
            "access_control_allow_origin": null,
            "cache_control": "no-store, max-age=0",
            "clear_site_data": null,
            "content_encoding": null,
            "content_security_policy": null,
            "content_type": "text/html; charset=utf-8",
            "cross_origin_embedder_policy": null,
            "cross_origin_opener_policy": null,
            "cross_origin_resource_policy": null,
            "expect_ct": null,
            "feature_policy": null,
            "last_modified": null,
            "permission_policy": null,
            "referrer_policy": null,
            "server": null,
            "set_cookie": "parking_session=<value>; expires=Tue, 06 Jan 2026 18:47:44 GMT; path=/",
            "strict_transport_security": null,
            "x_content_type_options": null,
            "x_download_options": null,
            "x_frame_options": null,
            "x_permitted_cross_domain_policies": null,
            "x_powered_by": null,
            "x_xss_protection": null
          },
          "cookies": [
            {
              "name": "parking_session",
              "value": "<value>"
            }
          ]
        }
      }
    }
  ]
}

Content-Type: application/json
ratelimit-limit: 1000
ratelimit-remaining: 999
ratelimit-reset: 1
x-ratelimit-limit-hour: 100000
x-ratelimit-limit-minute: 10000
x-ratelimit-limit-second: 1000
x-ratelimit-remaining-hour: 99641
x-ratelimit-remaining-minute: 9988
x-ratelimit-remaining-second: 999
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a

Request

What this example sends. Every parameter is documented on Domain Search; the exact request is in the code panel.

Parameter	Value
`page_size`query	`25`
`filters.must[0].name`body	`domain.name`
`filters.must[0].type`body	`contains_any`
`filters.must[0].value`body	`["login","verify","secure"]`

Reference updated September 26, 2026

Request

Related Examples