Attackers register the domain before they use it. A look-alike like acme-login.com or acme-security.net typically appears days to weeks before the phishing mail lands, the fake portal goes up, or the brand-impersonation campaign starts. This source is the window between registration and attack.
It aggregates newly-registered domains from 12 feeds — WHOIS and registrar lists, newly-registered-domain threat feeds, and TLS certificate transparency logs — deduplicated into one searchable index. Roughly 350,000 unique new domains land in it on a normal day.
This source is synchronous — one call returns the matching domains in the same response.
There are two ways in:
- Search by keyword — the one you want. Give it your brand and get back every new registration containing it.
- Browse the daily feed — every new domain for a date range, unfiltered. Useful for building your own pipeline over the raw feed.
Search by keyword
Send your brand as the domain parameter. Terms are comma-separated, each at least 3 characters, up to 200 terms per call.
The TLD is stripped before matching. Passing domain=acme.com searches for acme, not for the exact domain acme.com — so it also returns acme-login.net, myacme.io, and acmecorp.xyz. This is what you want for brand monitoring, but it means you cannot use this endpoint to ask “was this exact domain registered?”. Matching is a case-insensitive substring on the domain label, so short or generic terms produce a lot of noise: acme is a good term, pay is not.
start_date and end_date to search the whole index. That is the default and usually the right choice for a first sweep.
The full endpoint reference is domain_search_keyword.
This source costs 0 credits per call and is throttled at 1,000 requests per day.
Request parameters
What comes back
A page of domain records. The envelope carries the paging state and the domains are in results.
Envelope fields:
count — total domains matching the search, across all pages.total_pages — total pages available at the current page_size.next / previous — absolute URLs for the adjacent pages, or null at the ends.results — array of domain records.
Each record is one newly-registered domain:
domain — the registered domain.source — which feed reported it.created_at — when the feed reported it, as an ISO 8601 UTC timestamp.
created_at is when the feed reported the domain, not the registrar’s own registration timestamp. A domain can appear from several feeds on different days; the index deduplicates by domain, so you get one record with the earliest reporting feed.
Reading the results
Every hit is a lead, not a finding. A new domain containing your brand is not yet an attack — it has no site, no mail server, and no victims. What you are buying is time. Triage by intent:
- Does the pattern imply a login page?
acme-login, acme-sso, acme-verify, secure-acme are built to harvest credentials. Highest priority.
- Does it imply payment or support?
acmepay-support, acme-refund, acme-billing are the second wave, usually invoice or refund fraud.
- Is it a character swap or a different TLD?
acnne.com, acme.co next to your acme.com is typosquatting aimed at traffic and mistyped mail.
- Is it plausibly legitimate? A regional office, a partner, or a campaign microsite your own marketing team registered. Check internally before escalating.
For the domains that matter, the natural next steps are to pull the certificate history from SSL Transparency Logs to see whether a host is live yet, check Phishing References for a community report, and put the brand keyword on a monitoring rule so the next one reaches you without a manual sweep.
Browse the daily feed
Same response shape, no keyword. This returns every new domain in a date range, which on a normal day is several hundred thousand records.
Two differences from the keyword search:
domain is not accepted. Filter with source, start_date, and end_date only.- The dates default to today when omitted, rather than to the whole index. Set them explicitly for anything but the current day.
Reference: domain_search_list. Throttled at 1,000 requests per day, so pull large windows with a high page_size rather than many small pages.
Feeds
Twelve feeds contribute to the index. Pass any of these names to source, comma-separated, on any endpoint here:
NITT · Whoisfreaks · Shreshta Labs Weekly · Shreshta Labs Monthly · CENK NRD · xRuffKez NRD 14-day · xRuffKez NRD 14-day DGA · SSL Logs · Whoisextractor · Codepunch · Hagezi NRD7 · Opensquat
They overlap heavily by design — the same registration often appears in several — and they differ in latency and coverage. Filtering to one feed narrows your results and is rarely what you want for brand monitoring. Leave source off unless you are reconciling a specific feed.
Feed volume and health
domain_search_stats reports how much each feed delivered and whether it is currently working. Use it to sanity-check a quiet result: no hits for your brand means something different when a feed has been failing.
The response has four parts:
totals — unique, duplicate, and total_fetched across the range. unique is what actually entered the index; duplicate is what other feeds had already reported.by_day — the same three counts per day, each with its own by_source breakdown.by_source — per-feed counts across the whole range.sources_health — one entry per feed with name, is_healthy, last_run_at, last_status_code, and last_error.
A feed with last_run_at: null has not run yet and contributes nothing. A feed with is_healthy: false is failing upstream and its coverage is missing from the window you are looking at. Reference: domain_search_stats.
Export
domain_search_export returns a file download rather than JSON, with the columns Domain, Source, Created At, and Updated At.
The domain parameter decides which search is exported. With it you get exactly the keyword results, and the dates are optional bounds. Without it you get the date range, which defaults to today. source and ordering behave as they do on the search endpoints. file_format is csv by default or xlsx.
Reference: domain_search_export. Throttled at 1,000 requests per day. .svg?fit=max&auto=format&n=cJUhKEokp8h2t8Ke&q=85&s=2192fe0b4406e259cba34cdda8acffdc)
