# WhoisDS Newly Registered Domain Feed + Enrichment (`jungle_synthesizer/whoisds-newly-registered-domain-feed-scraper`) Actor Daily delta of newly registered domains from the whoisds.com free NRD feed, enriched with DNS (A/MX/NS), Certificate Transparency presence, IDN punycode decoding, and keyword/typosquat matching against a brand watch-list. Fully passive. - **URL**: https://apify.com/jungle\_synthesizer/whoisds-newly-registered-domain-feed-scraper.md - **Developed by:** [BowTiedRaccoon](https://apify.com/jungle_synthesizer) (community) - **Categories:** Developer tools, Automation, Lead generation - **Stats:** 3 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per event This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## WhoisDS Newly Registered Domain Feed Scraper Pulls the daily newly-registered-domain list from [whoisds.com](https://www.whoisds.com/newly-registered-domains) and enriches it with DNS records, Certificate Transparency presence, and IDN decoding. Returns up to 70,000 domains a day, filterable by TLD or keyword, with typosquat scoring against your own brand list. --- ### WhoisDS Newly Registered Domain Feed Scraper Features - Reads whoisds's free daily NRD list — no scraping of paywalled whois data, just the raw domain feed - Filters by TLD or keyword before enrichment, so you're not paying to resolve DNS for 70K domains you don't care about - Resolves A, MX, and NS records for every matched domain via public DNS - Checks Certificate Transparency logs (crt.sh) for a live or issued cert — opt-in, since it adds a request per domain - Decodes IDN/punycode domains to their Unicode form for homograph review - Scores each domain against a brand watch-list you supply, flagging close-but-not-identical matches as likely typosquats - Pure API + DNS lookups — no browser, no proxy, nothing actively probes the registered domain itself --- ### Who Uses Newly Registered Domain Data? - **Phishing-defense teams** — catch lookalike and typosquat domains the day they're registered, not weeks later when a campaign is already live - **Brand protection analysts** — feed the daily delta into a takedown queue instead of manually watching a registrar dashboard - **Threat intel researchers** — track registration patterns by TLD or keyword cluster across the free daily firehose - **Security tooling vendors** — build a defensive-domain-monitoring feature on top of a feed that already does the DNS/CT legwork --- ### How WhoisDS Newly Registered Domain Feed Scraper Works 1. Pick a date (or let it default to two days back — the feed needs a short lag to fully populate). 2. The actor fetches that day's domain list and filters it by TLD and/or keyword, if you supplied either. 3. Each matched domain gets resolved against public DNS and, if you asked for it, checked against Certificate Transparency logs. 4. Every record gets IDN-decoded and scored against your brand watch-list before it's saved — so what you get back is ready to triage, not a raw domain dump. --- ### Input ```json { "maxItems": 50, "tlds": ["com", "net"], "keywords": ["paypal", "bank"], "watchBrands": ["paypal", "chase", "wellsfargo"], "enrichDns": true, "checkCert": false } ```` | Field | Type | Default | Description | |-------|------|---------|-------------| | `maxItems` | integer | 50 | Maximum number of enriched domain records to emit for this run. | | `date` | string | 2 days before today (UTC) | Specific NRD list date to fetch, format `YYYY-MM-DD`. The feed publishes with a short lag, so recent dates can come back empty. | | `tlds` | array | none | Only emit domains under these TLDs (no leading dot, e.g. `com`, `xyz`). Leave empty for all TLDs. | | `keywords` | array | none | Only emit domains whose label contains one of these terms (case-insensitive substring match). | | `watchBrands` | array | none | Brand names to fuzzy-match new domains against for typosquat/homograph detection. Populates `typosquat_target`. | | `enrichDns` | boolean | true | Resolve A, MX, and NS records for each matched domain via public DNS. | | `checkCert` | boolean | false | Look up each matched domain in public Certificate Transparency logs (crt.sh). Adds one request per domain. | *** ### WhoisDS Newly Registered Domain Feed Scraper Output Fields ```json { "domain": "paypa1-secure-login.com", "registration_date": "2026-07-11", "tld": "com", "punycode_ascii": "paypa1-secure-login.com", "unicode_label": "paypa1-secure-login.com", "has_mx": false, "mx_hosts": [], "a_records": ["172.67.146.112"], "ns_hosts": ["wilson.ns.cloudflare.com", "walk.ns.cloudflare.com"], "has_active_cert": true, "typosquat_target": "paypal", "keyword_matched": "paypal", "first_seen_at": "2026-07-11T00:00:00.000Z", "scraped_at": "2026-07-13T06:36:11.766Z" } ``` | Field | Type | Description | |-------|------|--------------| | `domain` | string | Newly registered domain name, as listed by whoisds. | | `registration_date` | string | Date this domain appeared in the whoisds NRD list (UTC, `YYYY-MM-DD`). | | `tld` | string | Top-level label of the domain (e.g. `com`, `xyz`). | | `punycode_ascii` | string | ASCII/punycode (`xn--`) form of the domain. | | `unicode_label` | string | Decoded Unicode form of the domain, for IDN homograph review. | | `has_mx` | boolean | True if the domain has at least one MX record (mail-capable). | | `mx_hosts` | array | MX record hostnames, if any. | | `a_records` | array | Resolved IPv4 A records, if any. | | `ns_hosts` | array | Authoritative NS hostnames, if any. | | `has_active_cert` | boolean | True if a certificate for this domain appears in public Certificate Transparency logs. | | `typosquat_target` | string | Closest brand from your watch-list this domain fuzzy-matches, if any. | | `keyword_matched` | string | Watch-list keyword that matched this domain, if keyword filtering was used. | | `first_seen_at` | string | UTC timestamp for the start of the domain's `registration_date`. | | `scraped_at` | string | ISO-8601 timestamp when this record was scraped. | *** ### FAQ #### How do I scrape newly registered domains? WhoisDS Newly Registered Domain Feed Scraper reads whoisds's free daily NRD list and returns the domains registered on a given day, enriched with DNS and certificate data. No account or API key needed — the feed is public. #### How much does WhoisDS Newly Registered Domain Feed Scraper cost to run? It's priced per record on the standard PPE profile. DNS enrichment is included by default; Certificate Transparency lookups are opt-in via `checkCert` since they add a request per domain. #### Can I filter by TLD or keyword? Yes. Set `tlds` to restrict the feed to specific extensions, or `keywords` to only return domains whose label contains a watch-list term. Both are optional and can be combined. #### Does WhoisDS Newly Registered Domain Feed Scraper need proxies? No. It reads a public daily feed, resolves DNS, and queries a public Certificate Transparency log aggregator — nothing here needs a proxy or a browser. #### What does typosquat scoring actually check? `watchBrands` runs an edit-distance comparison against each domain's label. A close-but-not-identical match gets flagged in `typosquat_target` — an exact match is skipped, since that's presumably the brand registering its own domain. *** ### Need More Features? Need a different date range, extra enrichment fields, or a different filter shape? [File an issue](https://console.apify.com/actors/issues) or get in touch. ### Why Use WhoisDS Newly Registered Domain Feed Scraper? - **Delta, not a dump** — returns one day's new registrations, not a static domain-age lookup like most of the competition. - **Enrichment included** — DNS, Certificate Transparency, and typosquat scoring ship standard, so you're not stitching together three separate tools to triage a domain. - **Passive by design** — reads a published feed and public DNS/CT records only. Nothing ever connects to the domain itself. # Actor input Schema ## `sp_intended_usage` (type: `string`): Please describe how you plan to use the data extracted by this crawler. ## `sp_improvement_suggestions` (type: `string`): Provide any feedback or suggestions for improvements. ## `sp_contact` (type: `string`): Provide your email address so we can get in touch with you. ## `maxItems` (type: `integer`): Maximum number of enriched domain records to emit for this run. ## `date` (type: `string`): Specific NRD list date to fetch, format YYYY-MM-DD (UTC). Defaults to 2 days before today to account for feed publish lag. ## `tlds` (type: `array`): Only emit domains under these TLDs (no leading dot). Leave empty for all TLDs. ## `keywords` (type: `array`): Only emit domains whose label contains one of these terms (case-insensitive substring match). Leave empty for no keyword filtering. ## `watchBrands` (type: `array`): Brand names to fuzzy-match new domains against for typosquat/homograph detection (populates typosquat\_target). Leave empty to skip typosquat scoring. ## `enrichDns` (type: `boolean`): Resolve A, MX, and NS records for each matched domain via public DNS. ## `checkCert` (type: `boolean`): Look up each matched domain in public Certificate Transparency logs (crt.sh) to flag live or issued TLS certs. Adds one request per domain. ## Actor input object example ```json { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 50, "enrichDns": true, "checkCert": false } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 50 }; // Run the Actor and wait for it to finish const run = await client.actor("jungle_synthesizer/whoisds-newly-registered-domain-feed-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 50, } # Run the Actor and wait for it to finish run = client.actor("jungle_synthesizer/whoisds-newly-registered-domain-feed-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "maxItems": 50 }' | apify call jungle_synthesizer/whoisds-newly-registered-domain-feed-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=jungle_synthesizer/whoisds-newly-registered-domain-feed-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "WhoisDS Newly Registered Domain Feed + Enrichment", "description": "Daily delta of newly registered domains from the whoisds.com free NRD feed, enriched with DNS (A/MX/NS), Certificate Transparency presence, IDN punycode decoding, and keyword/typosquat matching against a brand watch-list. Fully passive.", "version": "0.1", "x-build-id": "QW8CFdB4V5EzJLrci" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/jungle_synthesizer~whoisds-newly-registered-domain-feed-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-jungle_synthesizer-whoisds-newly-registered-domain-feed-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/jungle_synthesizer~whoisds-newly-registered-domain-feed-scraper/runs": { "post": { "operationId": "runs-sync-jungle_synthesizer-whoisds-newly-registered-domain-feed-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/jungle_synthesizer~whoisds-newly-registered-domain-feed-scraper/run-sync": { "post": { "operationId": "run-sync-jungle_synthesizer-whoisds-newly-registered-domain-feed-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "maxItems" ], "properties": { "sp_intended_usage": { "title": "What is the intended usage of this data?", "minLength": 1, "type": "string", "description": "Please describe how you plan to use the data extracted by this crawler." }, "sp_improvement_suggestions": { "title": "How can we improve this crawler for you?", "minLength": 1, "type": "string", "description": "Provide any feedback or suggestions for improvements." }, "sp_contact": { "title": "Contact Email", "minLength": 1, "type": "string", "description": "Provide your email address so we can get in touch with you." }, "maxItems": { "title": "Max Items", "type": "integer", "description": "Maximum number of enriched domain records to emit for this run." }, "date": { "title": "Feed Date (UTC)", "type": "string", "description": "Specific NRD list date to fetch, format YYYY-MM-DD (UTC). Defaults to 2 days before today to account for feed publish lag." }, "tlds": { "title": "TLD Filter", "type": "array", "description": "Only emit domains under these TLDs (no leading dot). Leave empty for all TLDs.", "items": { "type": "string" } }, "keywords": { "title": "Keyword Watch-List", "type": "array", "description": "Only emit domains whose label contains one of these terms (case-insensitive substring match). Leave empty for no keyword filtering.", "items": { "type": "string" } }, "watchBrands": { "title": "Defended Brand List", "type": "array", "description": "Brand names to fuzzy-match new domains against for typosquat/homograph detection (populates typosquat_target). Leave empty to skip typosquat scoring.", "items": { "type": "string" } }, "enrichDns": { "title": "Enrich with DNS", "type": "boolean", "description": "Resolve A, MX, and NS records for each matched domain via public DNS.", "default": true }, "checkCert": { "title": "Check Certificate Transparency", "type": "boolean", "description": "Look up each matched domain in public Certificate Transparency logs (crt.sh) to flag live or issued TLS certs. Adds one request per domain.", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```