urlscan Pro – Newly Observed Domains (NOD) Feed

Our urlscan Pro platform tracks and consumes newly observed domains (NOD) and newly observed hostnames from a variety of datasources. We observe hundreds of thousands of new second-level (registered) domains per day and millions of unique hostnames and subdomains.

Our real-time feed of newly observed domains and hostnames allows our customers to consume this data, search through it and set up hunting rules and alerts for keywords or complex search expressions. Through our powerful query language, customers are able to multi-faceted queries for new items that they care about.

We also store historical observations per hostname and domain, allowing you to go back in time to see when and where an item was observed and whether it changed its DNS resolution over time.

The NOD feed in combination with our automated alerting and monitoring features as part of urlscan Observe allow our customers to automatically get notified about new domains and hostnames, and to trigger an automatic monitoring process which will continue to scan and resolve any new items for a certain amount of time after they have been discovered.

Due to the wealth of information we store, you can use our Search API for the following use-cases:

• Domain Impersonation - Set up alerting rules that monitor for typosquatted domains and brand impersonation
• Attack Surface Discovery - Enumerate all hosts and domains on a specific piece domain or network
• Infrastructure Pivoting - Find related domains by pivoting from known malicious infrastructure
• Subdomain Enumeration - See all hostnames on a specific domain