> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# New Domain Registrations

> Search domains registered in the last days across 12 registration and threat-intelligence feeds to catch look-alikes before a phishing campaign goes live

Attackers register the domain before they use it. A look-alike like `acme-login.com` or `acme-security.net` typically appears days to weeks before the phishing mail lands, the fake portal goes up, or the brand-impersonation campaign starts. This source is the window between registration and attack.

It aggregates newly-registered domains from **12 feeds** — WHOIS and registrar lists, newly-registered-domain threat feeds, and TLS certificate transparency logs — deduplicated into one searchable index. Roughly 350,000 unique new domains land in it on a normal day.

This source is **synchronous** — one call returns the matching domains in the same response.

There are two ways in:

* **Search by keyword** — the one you want. Give it your brand and get back every new registration containing it.
* **Browse the daily feed** — every new domain for a date range, unfiltered. Useful for building your own pipeline over the raw feed.

### Search by keyword

Send your brand as the `domain` parameter. Terms are comma-separated, each at least 3 characters, up to 200 terms per call.

```bash theme={"dark"}
# Every new registration containing "acme"
curl -G https://client-api.leak.center/api/service/domain_search_keyword/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "domain=acme" \
  --data-urlencode "page_size=100"
```

```bash theme={"dark"}
# Several brands at once, registered in the last week
curl -G https://client-api.leak.center/api/service/domain_search_keyword/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "domain=acme,acmebank,acmepay" \
  --data-urlencode "start_date=2026-01-08" \
  --data-urlencode "end_date=2026-01-15"
```

<Warning>
  **The TLD is stripped before matching.** Passing `domain=acme.com` searches for `acme`, not for the exact domain `acme.com` — so it also returns `acme-login.net`, `myacme.io`, and `acmecorp.xyz`. This is what you want for brand monitoring, but it means you cannot use this endpoint to ask "was this exact domain registered?". Matching is a case-insensitive substring on the domain label, so short or generic terms produce a lot of noise: `acme` is a good term, `pay` is not.
</Warning>

Omit `start_date` and `end_date` to search the whole index. That is the default and usually the right choice for a first sweep.

The full endpoint reference is [`domain_search_keyword`](https://client-api.leak.center/scalar-docs/#tag/domain-search/GET/api/service/domain_search_keyword/).

This source costs **0 credits** per call and is throttled at **1,000 requests per day**.

#### Request parameters

| Parameter    | Type    | Required | Notes                                                                                                                                    |
| ------------ | ------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| `domain`     | string  | Yes      | Comma-separated brands or keywords. Each term min 3 characters, up to 200 terms. The TLD is stripped, so `acme.com` searches for `acme`. |
| `start_date` | string  | No       | `YYYY-MM-DD` or ISO datetime. Lower bound on registration date. Omit to search all dates.                                                |
| `end_date`   | string  | No       | `YYYY-MM-DD` or ISO datetime. Upper bound. Omit to search all dates.                                                                     |
| `source`     | string  | No       | Restrict to one or more feeds, comma-separated. See [Feeds](#feeds) for the valid names.                                                 |
| `ordering`   | string  | No       | `domain`, `-domain`, `created_at`, or `-created_at`. Default `-created_at` — newest registrations first.                                 |
| `page`       | integer | No       | Page number, 1-based.                                                                                                                    |
| `page_size`  | integer | No       | Default `100`, max `100000`. Raise it for bulk pulls instead of paging.                                                                  |
| `org_id`     | integer | No       | Subsidiary organization ID, for system-level users querying a child organization.                                                        |

### What comes back

A page of domain records. The envelope carries the paging state and the domains are in `results`.

Envelope fields:

* `count` — total domains matching the search, across all pages.
* `total_pages` — total pages available at the current `page_size`.
* `next` / `previous` — absolute URLs for the adjacent pages, or `null` at the ends.
* `results` — array of domain records.

Each record is one newly-registered domain:

* `domain` — the registered domain.
* `source` — which feed reported it.
* `created_at` — when the feed reported it, as an ISO 8601 UTC timestamp.

```json theme={"dark"}
{
  "count": 322,
  "total_pages": 4,
  "next": "https://client-api.leak.center/api/service/domain_search_keyword/?domain=acme&page=2&page_size=100",
  "previous": null,
  "results": [
    {
      "domain": "acme-france.com",
      "source": "Whoisfreaks",
      "created_at": "2026-01-15T05:48:33.876577Z"
    },
    {
      "domain": "acme-login.net",
      "source": "SSL Logs",
      "created_at": "2026-01-15T05:47:12.481203Z"
    },
    {
      "domain": "acmepay-support.xyz",
      "source": "Opensquat",
      "created_at": "2026-01-14T05:48:46.797794Z"
    }
  ]
}
```

<Info>
  `created_at` is when the feed reported the domain, not the registrar's own registration timestamp. A domain can appear from several feeds on different days; the index deduplicates by domain, so you get one record with the earliest reporting feed.
</Info>

### Reading the results

Every hit is a **lead, not a finding**. A new domain containing your brand is not yet an attack — it has no site, no mail server, and no victims. What you are buying is time. Triage by intent:

* **Does the pattern imply a login page?** `acme-login`, `acme-sso`, `acme-verify`, `secure-acme` are built to harvest credentials. Highest priority.
* **Does it imply payment or support?** `acmepay-support`, `acme-refund`, `acme-billing` are the second wave, usually invoice or refund fraud.
* **Is it a character swap or a different TLD?** `acnne.com`, `acme.co` next to your `acme.com` is typosquatting aimed at traffic and mistyped mail.
* **Is it plausibly legitimate?** A regional office, a partner, or a campaign microsite your own marketing team registered. Check internally before escalating.

For the domains that matter, the natural next steps are to pull the certificate history from [SSL Transparency Logs](/api/guides/expert-ssl-logs) to see whether a host is live yet, check [Phishing References](/api/guides/expert-phishing) for a community report, and put the brand keyword on a [monitoring rule](/api/guides/monitoring-rules) so the next one reaches you without a manual sweep.

### Browse the daily feed

Same response shape, no keyword. This returns every new domain in a date range, which on a normal day is several hundred thousand records.

```bash theme={"dark"}
# Everything reported on one day, newest first
curl -G https://client-api.leak.center/api/service/domain_search_list/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "start_date=2026-01-15" \
  --data-urlencode "end_date=2026-01-15" \
  --data-urlencode "page_size=10000"
```

Two differences from the keyword search:

* `domain` is not accepted. Filter with `source`, `start_date`, and `end_date` only.
* **The dates default to today** when omitted, rather than to the whole index. Set them explicitly for anything but the current day.

Reference: [`domain_search_list`](https://client-api.leak.center/scalar-docs/#tag/domain-search/GET/api/service/domain_search_list/). Throttled at **1,000 requests per day**, so pull large windows with a high `page_size` rather than many small pages.

### Feeds

Twelve feeds contribute to the index. Pass any of these names to `source`, comma-separated, on any endpoint here:

`NITT` · `Whoisfreaks` · `Shreshta Labs Weekly` · `Shreshta Labs Monthly` · `CENK NRD` · `xRuffKez NRD 14-day` · `xRuffKez NRD 14-day DGA` · `SSL Logs` · `Whoisextractor` · `Codepunch` · `Hagezi NRD7` · `Opensquat`

They overlap heavily by design — the same registration often appears in several — and they differ in latency and coverage. Filtering to one feed narrows your results and is rarely what you want for brand monitoring. Leave `source` off unless you are reconciling a specific feed.

#### Feed volume and health

`domain_search_stats` reports how much each feed delivered and whether it is currently working. Use it to sanity-check a quiet result: no hits for your brand means something different when a feed has been failing.

```bash theme={"dark"}
curl -G https://client-api.leak.center/api/service/domain_search_stats/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "start_date=2026-01-15" \
  --data-urlencode "end_date=2026-01-15"
```

The response has four parts:

* `totals` — `unique`, `duplicate`, and `total_fetched` across the range. `unique` is what actually entered the index; `duplicate` is what other feeds had already reported.
* `by_day` — the same three counts per day, each with its own `by_source` breakdown.
* `by_source` — per-feed counts across the whole range.
* `sources_health` — one entry per feed with `name`, `is_healthy`, `last_run_at`, `last_status_code`, and `last_error`.

```json theme={"dark"}
{
  "start_date": "2026-01-15",
  "end_date": "2026-01-15",
  "totals": { "unique": 359898, "duplicate": 1063223, "total_fetched": 1423121 },
  "by_source": [
    { "source": "Whoisfreaks", "unique": 278743, "duplicate": 3638, "total_fetched": 282381 },
    { "source": "Opensquat", "unique": 32840, "duplicate": 67105, "total_fetched": 99945 },
    { "source": "SSL Logs", "unique": 8040, "duplicate": 1960, "total_fetched": 10000 }
  ],
  "sources_health": [
    {
      "name": "Whoisfreaks",
      "is_healthy": true,
      "last_run_at": "2026-01-15T05:49:16.660171+00:00",
      "last_status_code": 200,
      "last_error": null
    },
    {
      "name": "Hagezi NRD7",
      "is_healthy": false,
      "last_run_at": "2026-01-15T05:52:50.110600+00:00",
      "last_status_code": 404,
      "last_error": "404 Client Error: Not Found"
    }
  ]
}
```

A feed with `last_run_at: null` has not run yet and contributes nothing. A feed with `is_healthy: false` is failing upstream and its coverage is missing from the window you are looking at. Reference: [`domain_search_stats`](https://client-api.leak.center/scalar-docs/#tag/domain-search/GET/api/service/domain_search_stats/).

### Export

`domain_search_export` returns a file download rather than JSON, with the columns **Domain**, **Source**, **Created At**, and **Updated At**.

```bash theme={"dark"}
# Keyword results as CSV
curl -G https://client-api.leak.center/api/service/domain_search_export/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "domain=acme" \
  -o acme-new-domains.csv
```

```bash theme={"dark"}
# A full day of the feed as Excel
curl -G https://client-api.leak.center/api/service/domain_search_export/ \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --data-urlencode "start_date=2026-01-15" \
  --data-urlencode "end_date=2026-01-15" \
  --data-urlencode "file_format=xlsx" \
  -o new-domains.xlsx
```

The `domain` parameter decides which search is exported. **With** it you get exactly the keyword results, and the dates are optional bounds. **Without** it you get the date range, which defaults to today. `source` and `ordering` behave as they do on the search endpoints. `file_format` is `csv` by default or `xlsx`.

Reference: [`domain_search_export`](https://client-api.leak.center/scalar-docs/#tag/domain-search/GET/api/service/domain_search_export/). Throttled at **1,000 requests per day**.