Domain search takes one domain name and runs a full investigation on it. The answer has one result per source that found something, each with a readable summary (rows, lists) and its structured record (details): Starting from an address instead? Use Email search. Its owner’s handle? Username search.

Request

POST /v1/osint/domain, with a JSON body. domain is the only field. Refused with 400 invalid_request, nothing charged: an IP address, an email address, a name without a dot, and names that do not exist on the internet (localhost, .local, .internal, .onion, .test…). Any other field is refused too.
A search runs every source at the same time and usually answers in 20 to 40 seconds, after about 85 seconds at the latest: a source still running then gives what it has, or counts as failed. Set your HTTP client’s timeout to at least 100 seconds, as above.

What you get back

The envelope is module, query, count, results, cost, charged and credits - like the other OSINT modules (see Email search), without their sources tally; query is the domain as it was searched, cost is always 1. Each item of results has source, label and data:
rows and lists read like the other modules’ results. details is what to use in code. Its main fields, by source (any of them can be missing or null):
Results are untrusted text published by third parties: page titles, reviews, records. Show them as text, never as HTML, and do not follow their links automatically.

Cost and limits

1 credit a search, always, never from your daily quota: every source is asked in every search. When no source finds anything (a domain that does not exist), the credit is given back within the daily allowance. Invalid input costs nothing. See Credits and Limits.

Errors

How Orelys looks

Every source is passive or public: registries, DNS over HTTPS, certificate logs, public archives and review pages, and one visit of the site’s public pages (home, contact and legal pages, robots.txt, security.txt, ads.txt, the sitemap, the favicon), like a browser would. Nothing is scanned, no port is probed, no login is tried. The requests leave from Orelys’ network, never from yours.

Tips

  • Pivot on the tracking IDs. A Google Analytics, Tag Manager or AdSense ID found on two sites usually means one owner.
  • Search the favicon hash. http.favicon.hash:<mmh3> on Shodan finds other servers that serve the same icon, often the real server behind a CDN.
  • Chain the addresses. Each address in emails goes straight to Email search; a handle from website.socials to Username search.
  • Watch the lookalikes with a mail server. A registered variant that receives mail can send phishing that looks like it comes from the domain.

Reference

Domain search

Request and response schemas, every error, and a playground to try it.