Data Feeds
Newly Observed Domains (NOD)
While NRD focuses on the first appearance of a domain name in a registry (i.e. the domain registration), NOD focuses on the first time a domain name is observed in the DNS. Newly registered domains are sometimes purposely kept unconfigured for a period of time to avoid detection, making this data another valuable subset of domains to analyze when looking for malicious activity.
This can be extremely helpful to uncover newly registered domains for ccTLDs
whose registries chose not to disclose registration times (
.de, .es, .eu
and more).Format
JSON
Rate
The current rate is around 350,000 newly observed domains per day.Pricing
€699/month — talk to us at contact@dns0.eu to set up the subscription and get your API key.Threat intelligence partners get free or
discounted access to this data feed.
Authentication
Authenticate by passing your API key asBearer token in the Authorization header.
The WebSocket streaming endpoint is available without authentication for
testing purposes (up to 10 minutes per day).
Stream
WebSocket
WebSocket
The WebSocket endpoint is available at the following URL.
Google Cloud Pub/Sub
Google Cloud Pub/Sub
Upon request, you will be granted the
pubsub.subscriber role for the topic projects/dns0eu/topics/data.nod.Amazon SNS
Amazon SNS
Evaluating demand, please register your interest at contact@dns0.eu.
Azure Event Hubs
Azure Event Hubs
Evaluating demand, please register your interest at contact@dns0.eu.
Apache Kafka
Apache Kafka
Evaluating demand, please register your interest at contact@dns0.eu.
Download
Newline-delimited JSON dumps of the previous day’s stream are made available daily at the following URL.The file is updated every day between midnight and 1am UTC. Use conditional
requests (
If-Modified-Since) or make use of HEAD requests to avoid
unnecessary bandwidth usage.