rows, lists) and its structured record (details):
Starting from an address instead? Use Email search. Its owner’s handle? Username search.
Request
POST /v1/osint/domain, with a JSON body.
domain is the only field. Refused with 400 invalid_request, nothing charged: an IP address, an email address, a name without a dot, and names that do not exist on the internet (localhost, .local, .internal, .onion, .test…). Any other field is refused too.
failed. Set your HTTP client’s timeout to at least 100 seconds, as above.
What you get back
The envelope ismodule, query, count, results, cost, charged and credits - like the other OSINT modules (see Email search), without their sources tally; query is the domain as it was searched, cost is always 1. Each item of results has source, label and data:
rows and lists read like the other modules’ results. details is what to use in code. Its main fields, by source (any of them can be missing or null):
Cost and limits
1 credit a search, always, never from your daily quota: every source is asked in every search. When no source finds anything (a domain that does not exist), the credit is given back within the daily allowance. Invalid input costs nothing. See Credits and Limits.Errors
How Orelys looks
Every source is passive or public: registries, DNS over HTTPS, certificate logs, public archives and review pages, and one visit of the site’s public pages (home, contact and legal pages,robots.txt, security.txt, ads.txt, the sitemap, the favicon), like a browser would. Nothing is scanned, no port is probed, no login is tried. The requests leave from Orelys’ network, never from yours.
Tips
- Pivot on the tracking IDs. A Google Analytics, Tag Manager or AdSense ID found on two sites usually means one owner.
- Search the favicon hash.
http.favicon.hash:<mmh3>on Shodan finds other servers that serve the same icon, often the real server behind a CDN. - Chain the addresses. Each address in
emailsgoes straight to Email search; a handle fromwebsite.socialsto Username search. - Watch the lookalikes with a mail server. A registered variant that receives mail can send phishing that looks like it comes from the domain.
Reference
Domain search
Request and response schemas, every error, and a playground to try it.

