Newly Registered Domains Feed for Security and Domain Teams

The Newly Registered Domains feed lists every domain registered worldwide each day across 1528+ TLDs, enriched with WHOIS contact records and DNS records (A, MX, NS, TXT). Security teams use it to surface phishing and malware infrastructure within hours of registration. Brand teams use it to monitor cybersquatting and lookalike domains. Delivered twice daily as CSV download or REST API.

Contact sales
Get Started
NumDomain nameQuery timeCreate dateUpdate dateExpiry dateDomain registrar idDomain registrar nameDomain registrar whoisDomain registrar urlRegistrant nameRegistrant companyRegistrant addressRegistrant cityRegistrant stateRegistrant zipRegistrant country codeRegistrant countryRegistrant emailRegistrant phoneRegistrant faxAdministrative nameAdministrative companyAdministrative addressAdministrative cityAdministrative stateAdministrative zipAdministrative country codeAdministrative countryAdministrative emailAdministrative phoneAdministrative faxTechnical nameTechnical companyTechnical addressTechnical cityTechnical stateTechnical zipTechnical country codeTechnical countryTechnical emailTechnical phoneTechnical faxBilling nameBilling companyBilling addressBilling cityBilling stateBilling zipBilling country codeBilling countryBilling emailBilling phoneBilling faxName server 1Name server 2Name server 3Name server 4Domain status 1Domain status 2Domain status 3Domain status 4Reseller nameReseller emailReseller phone
1airport-jobs-28863.bond2023-10-12 09:19:522023-10-112023-10-112024-10-111345Key-Systems LLCwhois.rrpproxy.nethttp://www.key-systems.netN/AN/AN/AN/AN/AN/AUSUnited StatesPlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/ANS1.NIC53.NETNS2.NIC53.DEN/AN/AserverTransferProhibitedaddPeriodN/AN/AN/AN/AN/A
2infohato.online2023-10-12 09:19:522023-10-122023-10-122024-10-121636HOSTINGER operations, UABwhois.hostinger.comhttps://www.hostinger.com/N/APrivacy Protect, LLC (PrivacyP...N/AN/AMAN/AUSUnited StatesPlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/ANS1.DNS-PARKING.COMNS2.DNS-PARKING.COMN/AN/AclientTransferProhibitedserverTransferProhibitedaddPeriodN/AN/AN/AN/A
3hubserver.xyz2023-10-12 09:19:522023-10-112023-10-112024-10-111068Namecheapwhois.namecheap.comhttps://namecheap.comN/APrivacy service provided by Wi...N/AN/ACapital RegionN/AISIcelandPlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/AN/AN/AN/AN/AN/AN/AN/AN/APlease query the RDDS service ...N/AN/ATITAN.NS.CLOUDFLARE.COMKIA.NS.CLOUDFLARE.COMN/AN/AclientTransferProhibitedserverTransferProhibitedaddPeriodN/AN/AN/AN/A
4409hit.win2023-10-12 09:19:522023-10-112023-10-112024-10-11472Dynadot Incwhois.dynadot.comhttps://www.dynadot.com/REDACTED FOR PRIVACYSuper Privacy Service LTD c/o ...N/AREDACTED FOR PRIVACYCaliforniaREDACTED FOR PRIVACYUSUnited StatesPlease query the RDDS service ...REDACTED FOR PRIVACYREDACTED FOR PRIVACYREDACTED FOR PRIVACYREDACTED FOR PRIVACYN/AREDACTED FOR PRIVACYREDACTED FOR PRIVACYREDACTED FOR PRIVACYN/AREDACTED FOR PRIVACYPlease query the RDDS service ...REDACTED FOR PRIVACYREDACTED FOR PRIVACYREDACTED FOR PRIVACYREDACTED FOR PRIVACYN/AREDACTED FOR PRIVACYREDACTED FOR PRIVACYREDACTED FOR PRIVACYN/AREDACTED FOR PRIVACYPlease query the RDDS service ...REDACTED FOR PRIVACYREDACTED FOR PRIVACYN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/Ans1.dyna-ns.netns2.dyna-ns.netN/AN/AclientTransferProhibitedserverTransferProhibitedaddPeriodN/AN/AN/AN/A
5ygot45.com2023-10-12 09:19:522023-10-112023-10-112024-10-112487Internet Domain Service BS Cor...whois.internet.bshttp://www.internet.bsDomain AdminWhois Privacy Corp.N/ANassauNew Providence00000BSBahamas[email protected]...+1.5163872248N/ADomain AdminWhois Privacy Corp.N/ANassauNew Providence00000BSBahamas[email protected]...+1.5163872248N/ADomain AdminWhois Privacy Corp.N/ANassauNew Providence00000BSBahamas[email protected]...+1.5163872248N/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/AN/Ans2.wpx.netns1.wpx.netns3.wpx.netN/AclientTransferProhibitedN/AN/AN/AN/AN/AN/A
curl --location --request GET 'https://files.whoisfreaks.com/v3.3/download/domainer/gtld?apiKey=API_KEY&whois=true&date=2026-05-01'
pricing backgroundEclipse Top RightEclipse Top Left

Pricing

Newly Registered Domains Plans

Three tiers based on how much enrichment your workflow needs. All tiers cover 1528+ TLDs and ship twice daily.

DomainsOnly

Domains list without WHOIS & DNS. Best for blocklists and drop-catch monitoring.

$200
$167/month
Billed Yearly
Contains
A CSV file containing only a list of domain names, with no extra details.
Download domain lists as CSV via API.
Sample
More Info
Most Popular

WithWHOIS

Newly domains list with WHOIS data. Best for threat-intelligence pivots and brand investigations.

$400
$334/month
Billed Yearly
Contains:
Domain's owner data (technical, billing, administrator, registrant & reseller details)
Registrar details, dates, nameservers & domain statuses
APIs to download domains list and WHOIS data as CSV files.
Sample
More Info

With CleanedWHOIS

WHOIS records filtered to remove privacy proxies and disposable emails.

$600
$500/month
Billed Yearly
Contains:
All WHOIS data but with filtered masked entries (like REDACTED FOR PRIVACY, Not Disclosed, Privacy Service, etc)
APIs to download newly domains list, WHOIS data, and cleaned WHOIS data as CSV files.
Sample
More Info

DNSEnrichment

DNS records for newly registered domains, available as a separate enrichment tier.

$600
$500/month
Billed Yearly
Contains:
DNS records details for domains
Supported records include A, AAAA, NS, MX, SOA, SPF, TXT & CNAME
API to download DNS data of newly registered domains as JSONL file
Sample
More Info

Our Products

Daily Volume of NRD Feed by Tier
Daily counts of newly registered domains broken down by feed tier (gTLD, Cleaned gTLD, ccTLD, Cleaned ccTLD). Confirms feed depth before subscribing.
View Pricing
Download Sample CSV
Newly Registered Domains by gTLDs & ccTLDs
DategTLDsCleaned gTLDsccTLDsCleaned ccTLDs
2026-05-01243,66911,38981,61915,436
2026-04-30272,34415,04663,65014,191
2026-04-29286,82414,08077,90227,190
2026-04-28260,47813,69567,00526,172
2026-04-27206,4059,46138,3814,873
2026-04-26187,85310,46244,3125,022
2026-04-25254,23415,84959,2907,717

Product

Newly Registered Domains

Pull the daily NRD feed via REST API or download CSV from the dashboard, with full WHOIS and DNS records included.

Newly Registered Domains

Our Recently Registered Domains package provides WHOIS records, DNS details, cleaned WHOIS data, and lists of newly registered domains. Files are delivered as soon as they are prepared: previous-day ccTLDs are typically available around 3:00 AM UTC, and current-day gTLDs are typically delivered around 5:00 PM UTC, along with their DNS and WHOIS records.

Learn More
monitoring

Statistics

Daily NRD stats by Country and TLD
Daily counts split by registrant country and TLD. Surfaces geographic and TLD-level patterns that detection rules and brand-monitoring queries can filter against.
Request a Quote
View API Documentation
Newly Registered Domain names count by Country and TLD
DateCanadaChinaFranceGermanyIndiaUKUSA.com.in.net.uk.us.xyz
2026-05-014,0829,1783,7653,3913,4173,65766,501136,3402,6827,4993,8773,7797,654
2026-04-304,20713,2703,7043,8093,7343,61480,577149,2282,5987,9293,5806,7129,967
2026-04-294,28515,3693,6363,7323,5273,912109,315147,3112,6437,9283,42016,3145,425
2026-04-283,96313,4353,1333,7092,9533,05489,783143,2421,9885,2672,75521,8838,840
2026-04-273,27710,1742,0842,2812,5981,97178,35496,0231,9345,4612,4479713,891
2026-04-263,23311,8292,1972,8102,7891,94345,774100,7671,9947,0402,5309214,524
2026-04-253,85810,5553,4353,9263,6892,69973,683134,2572,6077,5403,9768525,970

Product

How the Feed Is Built and How Often It Updates

Our Newly Registered Domains feed covers over 1528+ TLDs, including both gTLDs and ccTLDs. It also provides associated DNS and WHOIS records to offer additional context. The dataset is updated twice daily, ensuring you have the most recent information to support more accurate and timely decision-making.

Continuous Scanning

We begin with continuous scanning. Our crawlers operate 24/7, crawling the internet to discover domains that are not in our database. These Newly identified domains are then added to daily changelog.

arrow

Source Integration

We download complete domain lists from different zone files and opensource projects, compare them with the previous day’s data as well as the domains in our database to detect changes and maintain a second changelog.

arrow

Coverage Expansion

At this stage ccTLD coverage is still not fully complete. ccTLD coverage spans more than 200 country-code registries, using proprietary methods with private registry integrations to maintain ccTLDs focused changelog.

arrow

Data Refinement

We now have complete changelog coverage, but the volume reaches millions of records. we apply extensive filtering based on multiple signals, such as the creation date, to remove noise from the feed.

arrow

Quality Assurance

Roughly 250,000 to 300,000 domains pass our QA filter each day, after de-duplication and zone-file reconciliation. A small amount of noise may still remain due to invalid signals, but our QA process removes it.

arrow

Contextualization

We now have the list of newly registered domains. Next, we enrich these domains with WHOIS and DNS data and package the datasets separately to meet the specific needs of different clients.

arrow

Publication

After the feeds are enriched, we make them available in multiple formats, such as downloadable CSV files, and add them to a filtering tool where users can refine the list as per their needs.

arrow

Delivery

Everything is now ready. Users can download the files via API, and we run this entire process twice a day to ensure they receive fresh data for marketing insights or threat intelligence.

Comparision

NRD Feed Comparison Table

This comparison highlights the technical advantages of the WhoisFreaks Newly Registered Domains (NRD) feed against common free and paid competitors.

See Pricing
Contact Sales
Capability
TLD Coverage
Update Frequency
WHOIS Records
DNS Records
Cleaned WHOIS
Delivery
Pre-filtering
Free Sources (whoisds, GitHub, zone dumps)
gTLDs only, partial ccTLDs
Daily (single batch)
Not included
Not included
Not included
Manual download
None
Whois XML API
Most gTLDs and ccTLDs
Daily
Included
Limited
Not available
API
Limited
WhoisFreaks
1528+ TLDs (gTLDs and ccTLDs)
Twice daily (gTLDs, ccTLDs, and DNS syncs)
Included (WHOIS and Cleaned tiers)
Comprehensive (A, AAAA, MX, NS, TXT)
Dedicated tier (filters proxy/disposable)
REST API, Dashboard and Email
Granular (Country, TLD, Registrar, etc.)

Features

What's Included in the NRD Feed

Pull the daily feed into your detection pipeline, threat-intel platform, or DNS blocklist with one API call or one CSV download.

Request a Quote
Contact Sales
Feature icon

Supported TLDs

WHOIS and DNS records for 1528+ TLDs covering both gTLDs (generic top-level domains like .com, .net, .org) and ccTLDs (country-code top-level domains like .uk, .de, .jp) across 200+ countries.

Feature icon

Supported Response Formats

Access newly registered domains in JSON or CSV formats, structured for quick ingestion into security workflows.Import the data into your SIEM, SOAR, or threat-intelligence platform without extra cleanup.

Feature icon

Advanced Filtration

Filter by country, TLD, registrar, registrant email, registrant name, or organization before download.Sort by domain name, expiry, creation, or update date, and export only the CSV columns you need.

Feature icon

Multiple Access Options

Pull data through the REST API for automated pipelines, using your API key as a request parameter.For one-off analysis or smaller workflows, download ready-to-use CSV files directly from the billing dashboard.

Use Cases

How Security Teams Use the NRD Feed

Security teams enrich detection pipelines with fresh-registration indicators of compromise.

Feature icon

Malware Campaign Tracking

Pivot from one C2 or malware-delivery domain to its registration cluster using registrar, nameserver or registrant, then export IoCs to MISP, OpenCTI, or other TI platforms.

Feature icon

Brand Protection & Cybersquatting

Track domains targeting your trademarks, typos, or subdomains, then pair NRDs with Reverse WHOIS API to uncover every domain tied to a known abusive registrant.

Feature icon

Attack Surface Discovery

Find new domains tied to your brand, products or infrastructure keywords, then feed matches into EASM tools to catch shadow IT, contractor domains, and missed assets.

Feature icon

DNS Blocklists and Network Defense

Block or rate-limit newly registered domains from the last 7, 14, or 30 days, with CSV support for Pi-hole, AdGuard Home, Zscaler, Cisco Umbrella, Quad9, and RPZ resolvers.

Feature icon

Phishing and Scam Detection

Match new registrations against brand terms, executive names, and homoglyphs to catch lookalike domains early, with cleaned WHOIS exposing stronger detection signals.

Feature icon

Threat Intelligence Enrichment

Pipe the daily feed into Splunk, Sentinel, MISP, or OpenCTI, with WHOIS and DNS data for quick pivots from suspicious domains to registrar and hosting details.

Request demo background

The newly registered domains feed gives security teams an early-warning signal for phishing and brand-abuse infrastructure, and gives domain teams a daily window into registration trends across 1528+ TLD.

Request Demo

FAQs

Have questions? Explore NRDs FAQs here.

What Are Newly Registered Domains?

Newly registered domains are domain names that are just registered, are brand new or re-registered after being dropped/deleted. By our broad and upto-date database you can get the list of recently registered domains and their complete WHOIS information daily.

Check out our new domain names list here.

What is Newly Registered Domains cleaned whois?

The Newly Registered Domains Cleaned WHOIS dataset contains entries featuring active Registrant email addresses, while excluding entries associated with disposable domains and proxy services, thus guaranteeing the accuracy of the information provided.

Check out our new domain names list here.

How do I access the newly registered domains feed?

You have two options. Use the REST API for automated pipelines, with API-key authentication and the schema documented in the API Reference . Or download CSV files from the billing dashboard, which is faster for one-off analysis and small teams.

A free sample CSV is available without an account: Download Sample .

How can I automatically get the WHOIS information from newly registered domain names?

You can get WHOIS information for newly registered domain names automatically through our recently registered domains WHOIS API on a daily basis. Checkout Newly Registered Domains API documentation to automate the process.

Check out our new domain names list here.

What is a newly registered domains list used for?

The most common workflows are threat-intelligence enrichment, phishing and brand-abuse detection, DNS blocklist generation, domain acquisition, and registration-trend research. Each is detailed in the Use Cases section above. Our terms of service prohibit use for unsolicited bulk email, and our cleaned WHOIS tier is filtered specifically for legitimate-interest workflows.

Can I get registrant email addresses for newly registered domains?

Registrant emails appear in WHOIS records when the registry publishes them. After GDPR (gdpr-info.eu) and ICANN's gTLD redaction policy (icann.org/resources/pages/gtld-registration-data-specs-en), individual registrants and most EU domains are redacted or proxied. Our cleaned WHOIS tier filters the daily feed to records where the registrant email is unredacted and not a privacy proxy or disposable address. Use cleaned WHOIS for detection rules, brand-abuse investigations, and legitimate-interest workflows. We do not support unsolicited bulk email.

How fresh is the newly registered data?

The WHOIS files for newly registered domains are updated for download at the following times:

  1. All ccTLD files are made available for download at 03:00 UTC, and they are of that previous day (not current day).
  2. Similarly, all gTLD files for a given day are made available for download at 13:30 UTC, and they all are of that particular day.
  3. DNS files are available for download at 02:00 UTC; however, they contain data from the previous day, not the current day.

We also notify you via email when each file is ready to download. Further, you can check file status through API.

Check out our new domain names list here.

Can I check programmatically any file type of generated domains WHOIS file status?

Yes, you can check details of WHOIS files through Files status API.

Check out our new domain names list here.

Is there any download limit to download files?

Yes, there is a limit to download WHOIS files. but it can be extended. Download limit will be shown in billing dashboard with usage.

Check out our new domain names list here.

How do I download list of newly registered websites?

For newly registered websites, you have two options:

  1. Download the list of newly registered domains and manually check which domains have DNS A or CNAME records.
  2. Subscribe to a service that provides newly registered domains with DNS records, allowing you to directly download the list of newly registered websites via an API or from the dashboard.

Check out our new domain names list here.

Can I register a new domain using your service?

No, our service does not support new domain registration. We only provide lists of newly registered domains for both gTLDs and ccTLDs. For new domain registration, you can use platforms like GoDaddy or Namecheap. However, if you need domain name suggestions, you can utilize our Domain Availability API to find the perfect name.

You can use our Domain Name Availability tool to check if any domain name is available.

Check out our new domain names list here.

Can I block newly registered domains using this feed?

Yes. The CSV format imports directly into Pi-hole, AdGuard Home, Zscaler, Cisco Umbrella, Quad9, and any RPZ-capable resolver. A common pattern is to block or rate-limit traffic to domains registered in the last 7, 14, or 30 days, which significantly reduces phishing and malware exposure.

The Domains Only tier is the cheapest path if blocking is your only use case. Full implementation guidance is in the How to Block Newly Registered Domains section above.

Ready to get started?Download a sample of 1,000 domains, updated daily!

Integrate newly registered domains with WHOIS and DNS data into your detection pipeline, brand-monitoring workflow, or domain-research stack. Start with a free CSV sample or talk to our team about volume-based API pricing.

Download Sample File