Find new domain registrations that match an organization's brand

A look-alike domain is registered before it is used. A name such as acme-login.com is often registered days or weeks before the first phishing mail or fake sign-in page goes out. This source shows you those registrations while they are still new. It collects newly registered domains from 9 feeds: WHOIS and registrar lists, newly-registered-domain threat feeds and certificate transparency logs. The index keeps one record per domain, so a domain that several feeds report appears once. Every call is synchronous. The answer comes back in the same response. Availability: Expert Search, included in every edition. Cost: no metered allowance. With an API key, each call that returns 2xx uses 1 unit of your monthly API Calls allowance, and a non-2xx response is refunded. Every call also counts toward the per-second rate limit. See Rate limits. When your license is not active, all four endpoints return 403:

{
  "detail": "Your license is not active."
}

Pick an endpoint

You want to…	Call
Find new registrations that contain your brand	`domain_search_keyword`
Read every new domain for a date range	`domain_search_list`
Download either result as CSV or Excel	`domain_search_export`
See how much each feed delivered and whether it is working	`domain_search_stats`

Search by keyword

Send your brand as domain to domain_search_keyword. To search several terms in one call, separate them with commas.

# Every new registration containing "acme"
curl -G https://client-api.leak.center/api/service/domain_search_keyword/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "domain=acme" \
  --data-urlencode "page_size=100"

# The same term, limited to registrations in one week
curl -G https://client-api.leak.center/api/service/domain_search_keyword/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "domain=acme" \
  --data-urlencode "start_date=2026-10-01" \
  --data-urlencode "end_date=2026-10-07"

Each term is reduced to a name before matching:

The term is lowercased.
Subdomains and the public suffix are removed, including two-part suffixes such as .co.uk. acme.com and login.acme.com both search for acme.
Duplicate names are dropped, so acme.com,login.acme.com runs one search.
The name is matched as a case-insensitive substring anywhere in the registered domain. acme returns acme-login.com and portal.acme-login.com.

You cannot look up one exact domain. domain=acme.com searches for acme, not for acme.com alone. Short or generic names return a lot of noise: acme is a useful term, pay is not.

A call takes up to 200 terms. Each name must be at least 3 characters after the suffix is removed, so ab is rejected, with or without a suffix. Omit start_date and end_date to search the whole index.

Narrow the matches

Three optional conditions cut the noise of a substring match. When you pass more than one, a domain must meet all of them.

Parameter	Keeps a domain when
`tld`	It ends with one of these TLDs, comma-separated. `com,ch` keeps `acme-login.com` and `acme.ch`. A leading dot is optional.
`hyphen_separated`	Set to `true`: a term is a whole word joined to another word by a hyphen, as in `acme-login.com` or `login-acme.ch`. `acmepay.com` is dropped.
`max_extra_characters`	A part between dots, other than the TLD, holds a term plus at most this many other characters. Dashes do not count. `2` keeps `acme24.com` and `acme-tv.com` and drops `acmeshop.com`. A whole number, `0` or more.

# "acme" as a hyphenated word, on .com and .ch only
curl -G https://client-api.leak.center/api/service/domain_search_keyword/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "domain=acme" \
  --data-urlencode "tld=com,ch" \
  --data-urlencode "hyphen_separated=true"

The conditions apply to the keyword search only. The list and the export do not take them.

Result cap

A keyword search returns at most 10,000 matches. The 10,000 are picked before sorting, so a capped result is not guaranteed to hold the newest registrations. A larger page_size does not lift the cap. When count is 10000, narrow the search with start_date, end_date, source or the conditions, or export the same domain. The export has no cap.

Request parameters

Parameter	Type	Required	Notes
`domain`	string	Yes	Comma-separated brands or domains. Up to 200 terms, each name at least 3 characters.
`start_date`	string	No	`YYYY-MM-DD` or an ISO datetime. Lower bound on `created_at`. Omit to search all dates.
`end_date`	string	No	`YYYY-MM-DD` or an ISO datetime. Upper bound on `created_at`. A date-only value covers the whole day. Omit to search all dates.
`source`	string	No	One or more feed names, comma-separated. See Feeds.
`tld`	string	No	One or more TLDs, comma-separated. See Narrow the matches.
`hyphen_separated`	boolean	No	Default `false`.
`max_extra_characters`	integer	No	`0` or more.
`ordering`	string	No	`domain`, `-domain`, `created_at` or `-created_at`. Default `-created_at`, newest first.
`page`	integer	No	Page number, starting at `1`.
`page_size`	integer	No	Default `100`, max `100000`.

Dates without a timezone are read as UTC.

What comes back

The envelope carries the paging state. The domains are in results.

count — matches across all pages. At most 10000 on a keyword search.
total_pages — pages available at the current page_size.
next / previous — the URLs of the adjacent pages on this API, or null at the ends.
results — one record per domain:
- domain — the registered domain.
- source — the feed that first reported it.
- created_at — when the index first recorded it, as an ISO 8601 UTC timestamp.

{
  "count": 2,
  "total_pages": 1,
  "next": null,
  "previous": null,
  "results": [
    {
      "domain": "acme-login.com",
      "source": "Whoisfreaks",
      "created_at": "2026-10-07T05:48:33.876577Z"
    },
    {
      "domain": "portal.acme-login.com",
      "source": "SSL Logs",
      "created_at": "2026-10-06T05:47:12.481203Z"
    }
  ]
}

created_at is when the index first recorded the domain, not the registrar’s registration timestamp. When several feeds report the same domain, the first one to report it is the source, and later reports add no new record.

Reading the results

Each hit is a registration, not an attack. The name tells you what it imitates:

Sign-in names. acme-login, acme-sso and acme-verify imitate a login page.
Payment and support names. acme-billing and acme-support imitate invoices, refunds or help desks.
Typos and other TLDs. A swapped character or a different TLD next to acme.com catches mistyped addresses and mail.
Your own registrations. A regional site or campaign domain your organization registered matches too.

To follow a domain further through the API:

SSL transparency logs show whether certificates have been issued for it.
Phishing references show whether phishing feeds list it.
Domain monitoring generates look-alike variations of your domain and checks them against new registrations and certificate logs for you.

Monitor new registrations

To receive new matches without repeating the search, create a monitor on the Domain Search service (16 in the service list) with your terms as args:

{"domain": "acme"}

The monitor applies the same rules as the keyword search: up to 200 terms, each name at least 3 characters. See Create and manage monitors.

Browse the daily feed

domain_search_list returns every new domain in a date range, with no keyword. The response has the same shape as the keyword search.

# Everything recorded on one day, newest first
curl -G https://client-api.leak.center/api/service/domain_search_list/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "start_date=2026-10-07" \
  --data-urlencode "end_date=2026-10-07" \
  --data-urlencode "page_size=10000"

It differs from the keyword search in three ways:

It takes no domain. Filter with start_date, end_date and source.
Omitted dates default to today (UTC), not to the whole index. Set them for any other day.
It has no 10,000 cap. count is every domain in the range.

A full day is a large result. Page with a high page_size, or export the range in one file.

Export

domain_search_export returns a file instead of JSON. The columns are Domain, Source, Created At and Updated At, with timestamps in ISO 8601.

# Every registration containing "acme", as CSV
curl -G https://client-api.leak.center/api/service/domain_search_export/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "domain=acme" \
  -o acme-new-domains.csv

# One day of the feed, as Excel
curl -G https://client-api.leak.center/api/service/domain_search_export/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "start_date=2026-10-07" \
  --data-urlencode "end_date=2026-10-07" \
  --data-urlencode "file_format=xlsx" \
  -o new-domains.xlsx

domain decides what the file holds:

With domain, the file holds every match for those terms. The keyword rules apply, the dates are optional bounds, and there is no 10,000 cap.
Without domain, the file holds the date range, which defaults to today (UTC).

source and ordering work as on the search endpoints. file_format is csv (default) or xlsx. The server names the file domain_registrations_<terms> or domain_registrations_<start>_to_<end>.

Feeds

Nine feeds supply new domains, once a day: Whoisfreaks · Shreshta Labs Weekly · Shreshta Labs Monthly · CENK NRD · SSL Logs · Whoisextractor · Codepunch · Hagezi NRD7 · Opensquat source also accepts three older feed names: NITT, xRuffKez NRD 14-day and xRuffKez NRD 14-day DGA. These feeds no longer deliver new domains, so filtering on them returns only older records. source takes these names in two ways:

Keyword search, list and export take one or more names, comma-separated, in any letter case. An unknown name returns 400.
Stats takes one name, spelled exactly as listed here.

The feeds overlap and differ in latency and coverage. Filtering to one feed narrows your results, so leave source off unless you are checking a specific feed.

Feed volume and health

domain_search_stats reports how many domains each feed delivered and whether its last run worked. Check it when a search returns nothing: a failing feed leaves a gap in the window you searched.

curl -G https://client-api.leak.center/api/service/domain_search_stats/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "start_date=2026-10-07" \
  --data-urlencode "end_date=2026-10-07"

start_date and end_date default to today (UTC). The counts cover the feed runs in that range.

totals — unique, duplicate and total_fetched across the range. unique domains were new to the index. duplicate domains were already in it.
by_day — the same three counts per day, each day with its own by_source breakdown.
by_source — the three counts per feed across the range, sorted by feed name.
sources_health — the current state of each feed: name, is_healthy, last_run_at, last_status_code and last_error. It does not depend on the date range.

{
  "start_date": "2026-10-07",
  "end_date": "2026-10-07",
  "totals": { "unique": 287823, "duplicate": 72343, "total_fetched": 360166 },
  "by_day": [
    {
      "date": "2026-10-07",
      "unique": 287823,
      "duplicate": 72343,
      "total_fetched": 360166,
      "by_source": [
        { "source": "Opensquat", "unique": 1040, "duplicate": 68905, "total_fetched": 69945 },
        { "source": "Whoisfreaks", "unique": 286783, "duplicate": 3438, "total_fetched": 290221 }
      ]
    }
  ],
  "by_source": [
    { "source": "Opensquat", "unique": 1040, "duplicate": 68905, "total_fetched": 69945 },
    { "source": "Whoisfreaks", "unique": 286783, "duplicate": 3438, "total_fetched": 290221 }
  ],
  "sources_health": [
    {
      "name": "Hagezi NRD7",
      "is_healthy": false,
      "last_run_at": "2026-10-07T05:52:50.110600+00:00",
      "last_status_code": 404,
      "last_error": "404 Client Error: Not Found"
    },
    {
      "name": "Whoisfreaks",
      "is_healthy": true,
      "last_run_at": "2026-10-07T05:49:16.660171+00:00",
      "last_status_code": 200,
      "last_error": null
    }
  ]
}

is_healthy: false means the feed’s last run failed, so its coverage is missing until a run succeeds. last_run_at: null means the feed has not run yet.

Errors

Status	When	Body
`400`	`domain` is missing on the keyword search	`{"domain": ["This field is required."]}`
`400`	A name is under 3 characters	`{"domain": ["Search term \"ab\" must be at least 3 characters."]}`
`400`	More than 200 terms	`{"domain": ["A maximum of 200 domains can be searched at once."]}`
`400`	An unknown feed name on keyword search, list or export	`{"non_field_errors": ["Invalid source(s): <name>."]}`
`400`	An unknown feed name on stats	`{"source": ["\"<name>\" is not a valid choice."]}`
`400`	`max_extra_characters` is below `0` or not a whole number	`{"max_extra_characters": [...]}` with `Ensure this value is greater than or equal to 0.` or `A valid integer is required.`
`400`	`ordering` is not one of the four values	`{"non_field_errors": ["Invalid ordering field. Valid options: domain, created_at."]}`
`400`	A date cannot be parsed, or `end_date` is before `start_date`	`{"non_field_errors": [...]}` with `Invalid date format. Use ISO formats such as YYYY-MM-DD.` or `end_date must be greater than or equal to start_date.`
`403`	Your license is not active	`{"detail": "Your license is not active."}`
`404`	`page` is past the last page	`{"detail": "Invalid page."}`
`429`	The per-second rate limit is hit, or the monthly API Calls allowance is spent	See Rate limits
`502` / `504`	The feed service failed or did not answer in time	See Errors

Endpoints

Action	Endpoint
Search new registrations by keyword	`GET /api/service/domain_search_keyword/`
List new registrations for a date range	`GET /api/service/domain_search_list/`
Export registrations as CSV or Excel	`GET /api/service/domain_search_export/`
Get feed volume and health	`GET /api/service/domain_search_stats/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Find new domain registrations that match an organization's brand

Pick an endpoint

Search by keyword

Narrow the matches

Result cap

Request parameters

What comes back

Reading the results

Monitor new registrations

Browse the daily feed

Export

Feeds

Feed volume and health

Errors

Endpoints

​Pick an endpoint

​Search by keyword

​Narrow the matches

​Result cap

​Request parameters

​What comes back

​Reading the results

​Monitor new registrations

​Browse the daily feed

​Export

​Feeds

​Feed volume and health

​Errors

​Endpoints

Pick an endpoint

Search by keyword

Narrow the matches

Result cap

Request parameters

What comes back

Reading the results

Monitor new registrations

Browse the daily feed

Export

Feeds

Feed volume and health

Errors

Endpoints