Newly Registered Domains Feed for Security & Brand-Protection Teams

The Newly Registered Domains (NRD) feed is a daily list of every domain registered worldwide across 1529+ TLDs, with WHOIS contact records and DNS records (A, MX, NS, TXT) attached. Security teams use it to surface phishing and malware infrastructure within hours of registration. Brand teams use it to catch cybersquatting and lookalike domains. It ships twice a day by REST API or CSV download, and you can start with a free sample of 1,000 domains, no account required.

Talk to Sales
Get your API key
pricing backgroundEclipse Top RightEclipse Top Left

Pricing

Newly Registered Domains Plans

Three tiers based on how much enrichment your workflow needs. All tiers cover 1529+ TLDs and ship twice daily.

Domains Only

Domains list without WHOIS & DNS. Best for blocklists and drop-catch monitoring.

$200
$167/month
Billed Yearly
Contains
A CSV file containing only a list of domain names, with no extra details.
Download domain lists as CSV via API.
Sample
More Info
Most Popular

With WHOIS

Newly domains list with WHOIS data. Best for threat-intelligence pivots and brand investigations.

$400
$334/month
Billed Yearly
Contains:
Domain's owner data (technical, billing, administrator, registrant & reseller details)
Registrar details, dates, nameservers & domain statuses
APIs to download domains list and WHOIS data as CSV files.
Sample
More Info

With Cleaned WHOIS

WHOIS records filtered to remove privacy proxies and disposable emails.

$600
$500/month
Billed Yearly
Contains:
All WHOIS data but with filtered masked entries (like REDACTED FOR PRIVACY, Not Disclosed, Privacy Service, etc)
APIs to download newly domains list, WHOIS data, and cleaned WHOIS data as CSV files.
Sample
More Info

DNS Enrichment

DNS records for newly registered domains, available as a separate enrichment tier.

$600
$500/month
Billed Yearly
Contains:
DNS records details for domains
Supported records include A, AAAA, NS, MX, SOA, SPF, TXT & CNAME
API to download DNS data of newly registered domains as JSONL file
Sample
More Info

Our Products

Daily Volume of NRD Feed by Tier

Daily counts of newly registered domains broken down by feed tier (gTLD, Cleaned gTLD, ccTLD, Cleaned ccTLD). Confirms feed depth before subscribing.
View Pricing
Download Free Sample

Newly Registered Domains by gTLDs & ccTLDs

DategTLDsCleaned gTLDsccTLDsCleaned ccTLDs
2026-07-29281,3277,68273,37115,147
2026-07-28244,7116,01451,73111,056
2026-07-27187,0869,54852,95710,936
2026-07-26183,9203,57650,2988,455
2026-07-25260,6115,36065,68417,043
2026-07-24261,301060,28312,221
2026-07-23299,52210,99861,68512,683

Product

Newly Registered Domains

Pull the daily NRD feed via REST API or download CSV from the dashboard, with full WHOIS and DNS records included.

Newly Registered Domains

Our Recently Registered Domains package provides WHOIS records, DNS details, cleaned WHOIS data, and lists of newly registered domains. Files publish on a fixed daily schedule: previous-day ccTLD files at 03:00 AM UTC, DNS files at 04:00 AM UTC, and current-day gTLD files at 5:00 PM UTC. You get an email when each file is ready, and you can check file status through the API.

Learn More
monitoring

Statistics

Daily NRD stats by Country and TLD

Daily counts split by registrant country and TLD. Surfaces geographic and TLD-level patterns that detection rules and brand-monitoring queries can filter against.
Request a Quote
View API Documentation

Newly Registered Domain names count by Country and TLD

DateCanadaChinaFranceGermanyIndiaUKUSA.com.in.net.uk.us.xyz
2026-07-294,12516,8154,2243,0373,4592,67478,733125,1222,5478,0353,5659046,792
2026-07-283,7609,1883,1413,0023,4502,69668,162119,3222,2795,3353,0667165,557
2026-07-273,0145,5012,3901,8752,9421,88155,91182,9172,1675,6152,6529503,916
2026-07-262,9515,2533,1512,2583,2941,83449,31383,5882,4486,2023,2724124,249
2026-07-253,5239,4594,0922,9263,6912,36562,556115,3032,7007,5213,5549796,027
2026-07-243,9028,3754,1332,7623,4372,34369,704122,8702,2847,3393,5911,0085,367
2026-07-234,31218,1164,3172,8793,5252,61273,008119,6632,4588,4013,1861,19814,517

Product

How the Feed Is Built and How Often It Updates

Our Newly Registered Domains feed covers 1529+ TLDs across both gTLDs and ccTLDs, with matching WHOIS and DNS records for every domain. It refreshes twice a day, so a domain registered this morning can be in your detection pipeline or blocklist by tonight.

Continuous Scanning

We begin with continuous scanning. Our crawlers operate 24/7, crawling the internet to discover domains that are not in our database. These Newly identified domains are then added to daily changelog.

arrow

Source Integration

We download complete domain lists from different zone files and opensource projects, compare them with the previous day’s data as well as the domains in our database to detect changes and maintain a second changelog.

arrow

Coverage Expansion

At this stage ccTLD coverage is still not fully complete. ccTLD coverage spans more than 200 country-code registries, using proprietary methods with private registry integrations to maintain ccTLDs focused changelog.

arrow

Data Refinement

We now have complete changelog coverage, but the volume reaches millions of records. we apply extensive filtering based on multiple signals, such as the creation date, to remove noise from the feed.

arrow

Quality Assurance

Roughly 250,000 to 300,000 domains pass our QA filter each day, after de-duplication and zone-file reconciliation. A small amount of noise may still remain due to invalid signals, but our QA process removes it.

arrow

Contextualization

We now have the list of newly registered domains. Next, we enrich these domains with WHOIS and DNS data and package the datasets separately to meet the specific needs of different clients.

arrow

Publication

After the feeds are enriched, we make them available in multiple formats, such as downloadable CSV files, and add them to a filtering tool where users can refine the list as per their needs.

arrow

Delivery

Files are then published to the API and dashboard. The full pipeline runs twice a day, so security and brand teams pull fresh registrations without waiting on a weekly dump.

Comparison

NRD Feed Comparison Table

This comparison highlights the technical advantages of the WhoisFreaks Newly Registered Domains (NRD) feed against common free and paid competitors.

See Pricing
Talk to sales
Capability
TLD Coverage
Update Frequency
WHOIS Records
DNS Records
Cleaned WHOIS
Delivery
Pre-filtering
Free Sources (whoisds, GitHub, zone dumps)
gTLDs only, partial ccTLDs
Daily (single batch)
Not included
Not included
Not included
Manual download
None
Whois XML API
Most gTLDs and ccTLDs
Daily
Included
Limited
Not available
API
Limited
WhoisFreaks
1529+ TLDs (gTLDs and ccTLDs)
Twice daily (gTLDs, ccTLDs, and DNS syncs)
Included (WHOIS and Cleaned tiers)
Comprehensive (A, AAAA, MX, NS, TXT)
Dedicated tier (filters proxy/disposable)
REST API, Dashboard and Email
Granular (Country, TLD, Registrar, etc.)

Features

What's Included in the NRD Feed

Pull the daily feed into your detection pipeline, threat-intel platform, or DNS blocklist with one API call or one CSV download.

Request a Quote
Talk to sales
Feature icon

Supported TLDs

WHOIS and DNS records for 1529+ TLDs covering both gTLDs (generic top-level domains like .com, .net, .org) and ccTLDs (country-code top-level domains like .uk, .de, .jp) across 200+ countries.

Feature icon

Supported Response Formats

Access newly registered domains in JSON or CSV formats, structured for quick ingestion into security workflows. Import the data into your SIEM, SOAR, or threat-intelligence platform without extra cleanup.

Feature icon

Advanced Filtration

Filter by country, TLD, registrar, registrant email, registrant name, or organization before download. Sort by domain name, expiry, creation, or update date, and export only the CSV columns you need.

Feature icon

Multiple Access Options

Pull data through the REST API for automated pipelines, using your API key as a request parameter. For one-off analysis or smaller workflows, download ready-to-use CSV files directly from the billing dashboard.

Use Cases

How Security Teams Use the NRD Feed

Security teams enrich detection pipelines with fresh-registration indicators of compromise.

Feature icon

Malware Campaign Tracking

Pivot from one C2 or malware-delivery domain to its registration cluster using registrar, nameserver or registrant, then export IoCs to MISP, OpenCTI, or other TI platforms.

Feature icon

Brand Protection & Cybersquatting

Track domains targeting your trademarks, typos, or subdomains, then pair NRDs with Reverse WHOIS API to uncover every domain tied to a known abusive registrant.

Feature icon

Attack Surface Discovery

Find new domains tied to your brand, products or infrastructure keywords, then feed matches into EASM tools to catch shadow IT, contractor domains, and missed assets.

Feature icon

DNS Blocklists and Network Defense

Block or rate-limit newly registered domains from the last 7, 14, or 30 days, with CSV support for Pi-hole, AdGuard Home, Zscaler, Cisco Umbrella, Quad9, and RPZ resolvers.

Feature icon

Phishing and Scam Detection

Match new registrations against brand terms, executive names, and homoglyphs to catch lookalike domains early, with cleaned WHOIS exposing stronger detection signals.

Feature icon

Threat Intelligence Enrichment

Pipe the daily feed into Splunk, Sentinel, MISP, or OpenCTI, with WHOIS and DNS data for quick pivots from suspicious domains to registrar and hosting details.

Request demo background

The newly registered domains feed gives security teams an early-warning signal for phishing and brand-abuse infrastructure, and gives domain teams a daily window into registration trends across 1529+ TLD.

Request Demo

Related Domain Threat Feeds

Domain Typosquatting API

Domain Typosquatting API

Check the feed for the typo and lookalike variants of your brand instead of scanning it all by hand.

Domain Typosquatting API
Expired Domains API

Expired Domains API

Track the other end of the lifecycle with daily dropped, deleted, and pending-delete domain lists.

Expired Domains API
Threat Intelligence Feeds

Threat Intelligence Feeds

Get daily CSV feeds for phishing, malware, spam, botnet, and C2 domains, with every record scored.

Threat Intelligence Feeds

FAQs

Have questions? Explore NRDs FAQs here.

What Are Newly Registered Domains?

Newly registered domains are domain names that are just registered, are brand new or re-registered after being dropped/deleted. By our broad and upto-date database you can get the list of recently registered domains and their complete WHOIS information daily.

Check out our new domain names list here.

What is Newly Registered Domains cleaned whois?

The Newly Registered Domains Cleaned WHOIS dataset contains entries featuring active Registrant email addresses, while excluding entries associated with disposable domains and proxy services, thus guaranteeing the accuracy of the information provided.

Check out our new domain names list here.

How do I access the newly registered domains feed?

You have two options. Use the REST API for automated pipelines, with API-key authentication and the schema documented in the API Reference . Or download CSV files from the billing dashboard, which is faster for one-off analysis and small teams.

A free sample CSV is available without an account: Download Sample .

How can I automatically get the WHOIS information from newly registered domain names?

You can get WHOIS information for newly registered domain names automatically through our recently registered domains WHOIS API on a daily basis. Checkout Newly Registered Domains API documentation to automate the process.

Check out our new domain names list here.

What is a newly registered domains list used for?

The most common workflows are threat-intelligence enrichment, phishing and brand-abuse detection, DNS blocklist generation, domain acquisition, and registration-trend research. Each is detailed in the Use Cases section above. Our terms of service prohibit use for unsolicited bulk email, and our cleaned WHOIS tier is filtered specifically for legitimate-interest workflows.

Can I get registrant email addresses for newly registered domains?

Registrant emails appear in WHOIS records when the registry publishes them. After GDPR (gdpr-info.eu) and ICANN's gTLD redaction policy (icann.org/resources/pages/gtld-registration-data-specs-en), individual registrants and most EU domains are redacted or proxied. Our cleaned WHOIS tier filters the daily feed to records where the registrant email is unredacted and not a privacy proxy or disposable address. Use cleaned WHOIS for detection rules, brand-abuse investigations, and legitimate-interest workflows. We do not support unsolicited bulk email.

How fresh is the newly registered data?

The WHOIS files for newly registered domains are updated for download at the following times:

  1. All ccTLD files are made available for download at 03:00 UTC, and they are of that previous day (not current day).
  2. Similarly, all gTLD files for a given day are made available for download at 5:00 PM UTC, and they all are of that particular day.
  3. DNS files are available for download at 04:00 AM UTC; however, they contain data from the previous day, not the current day.

We also notify you via email when each file is ready to download. Further, you can check file status through API.

Check out our new domain names list here.

Can I check programmatically any file type of generated domains WHOIS file status?

Yes, you can check details of WHOIS files through Files status API.

Check out our new domain names list here.

Is there any download limit to download files?

Yes, there is a limit to download WHOIS files. but it can be extended. Download limit will be shown in billing dashboard with usage.

Check out our new domain names list here.

How do I download list of newly registered websites?

For newly registered websites, you have two options:

  1. Download the list of newly registered domains and manually check which domains have DNS A or CNAME records.
  2. Subscribe to a service that provides newly registered domains with DNS records, allowing you to directly download the list of newly registered websites via an API or from the dashboard.

Check out our new domain names list here.

Can I register a new domain using your service?

No, our service does not support new domain registration. We only provide lists of newly registered domains for both gTLDs and ccTLDs. For new domain registration, you can use platforms like GoDaddy or Namecheap. However, if you need domain name suggestions, you can utilize our Domain Availability API to find the perfect name.

You can use our Domain Name Availability tool to check if any domain name is available.

Check out our new domain names list here.

Can I block newly registered domains using this feed?

Yes. The CSV format imports directly into Pi-hole, AdGuard Home, Zscaler, Cisco Umbrella, Quad9, and any RPZ-capable resolver. A common pattern is to block or rate-limit traffic to domains registered in the last 7, 14, or 30 days, which significantly reduces phishing and malware exposure.

The Domains Only tier is the cheapest path if blocking is your only use case. Full implementation guidance is in the How to Block Newly Registered Domains section above.

Is there a free newly registered domains list?

Yes. You can download a free sample of 1,000 newly registered domains with WHOIS and DNS every day, with no account and no API key. Pull it straight from the sample endpoint:

https://files.whoisfreaks.com/v3.1/download/domainer/sample/gtld?whois=true

Cleaned-WHOIS and DNS samples are available at /sample/gtld/cleaned and /sample/newly/dns. Free public sources (whoisds, GitHub dumps, zone files) cover gTLDs only, ship once a day, and include no WHOIS or DNS. The paid feed adds full ccTLD coverage across 1528+ TLDs, cleaned WHOIS, DNS enrichment, and twice-daily delivery.

For the full daily feed, add your API key to the documented download endpoint:

curl -X GET "https://files.whoisfreaks.com/v3.3/download/domainer/gtld?apiKey=API_KEY&whois=true&date=YYYY-MM-DD"
curl -X GET "https://files.whoisfreaks.com/v3.3/download/domainer/cctld?apiKey=API_KEY&whois=true&date=YYYY-MM-DD"

Can I get newly registered domains through an API?

Yes. Pull the daily NRD feed programmatically via the REST API using your API key, or download CSV files from the dashboard. The API is documented in the Newly Registered Domains API reference and works with Python, Go, Node.js, cURL, and any HTTP client.
Ready to get started?Download a sample of 1,000 domains, updated daily!

Integrate newly registered domains with WHOIS and DNS data into your detection pipeline, brand-monitoring workflow, or domain-research stack. Start with a free CSV sample or talk to our team about volume-based API pricing.

Download Free Sample