WhoisDS Newly Registered Domain Feed Scraper

Pulls the daily newly-registered-domain list from whoisds.com and enriches it with DNS records, Certificate Transparency presence, and IDN decoding. Returns up to 70,000 domains a day, filterable by TLD or keyword, with typosquat scoring against your own brand list.

---

WhoisDS Newly Registered Domain Feed Scraper Features

• Reads whoisds's free daily NRD list — no scraping of paywalled whois data, just the raw domain feed
• Filters by TLD or keyword before enrichment, so you're not paying to resolve DNS for 70K domains you don't care about
• Resolves A, MX, and NS records for every matched domain via public DNS
• Checks Certificate Transparency logs (crt.sh) for a live or issued cert — opt-in, since it adds a request per domain
• Decodes IDN/punycode domains to their Unicode form for homograph review
• Scores each domain against a brand watch-list you supply, flagging close-but-not-identical matches as likely typosquats
• Pure API + DNS lookups — no browser, no proxy, nothing actively probes the registered domain itself

---

Who Uses Newly Registered Domain Data?

• Phishing-defense teams — catch lookalike and typosquat domains the day they're registered, not weeks later when a campaign is already live
• Brand protection analysts — feed the daily delta into a takedown queue instead of manually watching a registrar dashboard
• Threat intel researchers — track registration patterns by TLD or keyword cluster across the free daily firehose
• Security tooling vendors — build a defensive-domain-monitoring feature on top of a feed that already does the DNS/CT legwork

---

How WhoisDS Newly Registered Domain Feed Scraper Works

1. Pick a date (or let it default to two days back — the feed needs a short lag to fully populate).
2. The actor fetches that day's domain list and filters it by TLD and/or keyword, if you supplied either.
3. Each matched domain gets resolved against public DNS and, if you asked for it, checked against Certificate Transparency logs.
4. Every record gets IDN-decoded and scored against your brand watch-list before it's saved — so what you get back is ready to triage, not a raw domain dump.

---

Input

{
  "maxItems": 50,
  "tlds": ["com", "net"],
  "keywords": ["paypal", "bank"],
  "watchBrands": ["paypal", "chase", "wellsfargo"],
  "enrichDns": true,
  "checkCert": false
}

Field	Type	Default	Description
maxItems	integer	50	Maximum number of enriched domain records to emit for this run.
date	string	2 days before today (UTC)	Specific NRD list date to fetch, format YYYY-MM-DD. The feed publishes with a short lag, so recent dates can come back empty.
tlds	array	none	Only emit domains under these TLDs (no leading dot, e.g. com, xyz). Leave empty for all TLDs.
keywords	array	none	Only emit domains whose label contains one of these terms (case-insensitive substring match).
watchBrands	array	none	Brand names to fuzzy-match new domains against for typosquat/homograph detection. Populates typosquat_target.
enrichDns	boolean	true	Resolve A, MX, and NS records for each matched domain via public DNS.
checkCert	boolean	false	Look up each matched domain in public Certificate Transparency logs (crt.sh). Adds one request per domain.

---

WhoisDS Newly Registered Domain Feed Scraper Output Fields

{
  "domain": "paypa1-secure-login.com",
  "registration_date": "2026-07-11",
  "tld": "com",
  "punycode_ascii": "paypa1-secure-login.com",
  "unicode_label": "paypa1-secure-login.com",
  "has_mx": false,
  "mx_hosts": [],
  "a_records": ["172.67.146.112"],
  "ns_hosts": ["wilson.ns.cloudflare.com", "walk.ns.cloudflare.com"],
  "has_active_cert": true,
  "typosquat_target": "paypal",
  "keyword_matched": "paypal",
  "first_seen_at": "2026-07-11T00:00:00.000Z",
  "scraped_at": "2026-07-13T06:36:11.766Z"
}

Field	Type	Description
domain	string	Newly registered domain name, as listed by whoisds.
registration_date	string	Date this domain appeared in the whoisds NRD list (UTC, YYYY-MM-DD).
tld	string	Top-level label of the domain (e.g. com, xyz).
punycode_ascii	string	ASCII/punycode (xn--) form of the domain.
unicode_label	string	Decoded Unicode form of the domain, for IDN homograph review.
has_mx	boolean	True if the domain has at least one MX record (mail-capable).
mx_hosts	array	MX record hostnames, if any.
a_records	array	Resolved IPv4 A records, if any.
ns_hosts	array	Authoritative NS hostnames, if any.
has_active_cert	boolean	True if a certificate for this domain appears in public Certificate Transparency logs.
typosquat_target	string	Closest brand from your watch-list this domain fuzzy-matches, if any.
keyword_matched	string	Watch-list keyword that matched this domain, if keyword filtering was used.
first_seen_at	string	UTC timestamp for the start of the domain's registration_date.
scraped_at	string	ISO-8601 timestamp when this record was scraped.

---

FAQ

How do I scrape newly registered domains?

WhoisDS Newly Registered Domain Feed Scraper reads whoisds's free daily NRD list and returns the domains registered on a given day, enriched with DNS and certificate data. No account or API key needed — the feed is public.

How much does WhoisDS Newly Registered Domain Feed Scraper cost to run?

It's priced per record on the standard PPE profile. DNS enrichment is included by default; Certificate Transparency lookups are opt-in via checkCert since they add a request per domain.

Can I filter by TLD or keyword?

Yes. Set tlds to restrict the feed to specific extensions, or keywords to only return domains whose label contains a watch-list term. Both are optional and can be combined.

Does WhoisDS Newly Registered Domain Feed Scraper need proxies?

No. It reads a public daily feed, resolves DNS, and queries a public Certificate Transparency log aggregator — nothing here needs a proxy or a browser.

What does typosquat scoring actually check?

watchBrands runs an edit-distance comparison against each domain's label. A close-but-not-identical match gets flagged in typosquat_target — an exact match is skipped, since that's presumably the brand registering its own domain.

---

Need More Features?

Need a different date range, extra enrichment fields, or a different filter shape? File an issue or get in touch.

Why Use WhoisDS Newly Registered Domain Feed Scraper?

• Delta, not a dump — returns one day's new registrations, not a static domain-age lookup like most of the competition.
• Enrichment included — DNS, Certificate Transparency, and typosquat scoring ship standard, so you're not stitching together three separate tools to triage a domain.
• Passive by design — reads a published feed and public DNS/CT records only. Nothing ever connects to the domain itself.