Newly Registered Domains List
Every day, hundreds of thousands of new domain names are registered. Most become ordinary websites, from new shops to personal blogs. A small share are set up for phishing, scams or brand abuse, often within days of registration.
This page explains what newly registered domains are, why security and brand teams watch them, and how a categorized feed turns a raw stream of names into something you can act on.
What is a newly registered domain?
A newly registered domain, often shortened to NRD, is a domain name registered recently. Most tools use a window of the last 30 days, though some use 7, 60 or 90 days depending on their risk appetite.
Recent registration
The defining fact is age. A domain registered last Tuesday is an NRD; a ten-year-old domain that just changed owner is not, even if it is risky.
Any ending
New domains appear under .com, country endings and the newer generic endings. Some cheaper endings see far more short-lived registrations than others, which is why many policies weigh the ending as well as the age.
Often empty at first
Many new domains show a placeholder, a parking page or nothing at all for days or weeks before a real site appears.
Unknown reputation
A new domain has no history. Blocklists, reputation scores and search engines have not seen it yet, which is exactly why attackers like them.
The life of a new domain
What happens in the first month after registration explains both the risk and the categorization challenge.
Registered
The name is bought. Often nothing resolves yet, or the registrar shows a default page.
First content, or first abuse
Legitimate owners may put up a placeholder. Abusive owners often launch at once: a fake login page, a scam shop or a malware download, timed before blocklists catch up.
Real sites take shape
New shops, blogs and company sites start adding pages. Many short-lived abusive domains are already reported or abandoned.
Content settles
Most real sites now show what they are about. Domains that still show nothing are often parked, held for resale or simply forgotten.
Leaves the NRD window
The domain is now treated like any other. From here, regular refreshes keep its category current.
Why security teams want newly registered domains
For security teams, new domains are a known weak spot. Reputation-based defences need history, and a new domain has none.
Phishing
Fake login pages for banks, email and cloud services are often hosted on domains only days old, then dropped once reported.
Malware delivery
Download and command servers rotate through fresh domains so that static blocklists are always one step behind.
Scam shops
Fake stores with unrealistic discounts appear around holidays and big sales, live for a few weeks, then vanish.
Email filtering
Links and sender domains that are only days old are a strong signal for mail security scoring.
Blocking all NRDs
- Simple to set up on many filters
- Stops most fresh phishing domains
- Also blocks new suppliers, campaign sites and legitimate start-ups
- Creates helpdesk tickets and pressure to switch it off
Categorized NRDs
- Block new domains in risky categories at once
- Flag or isolate new domains with no clear content yet
- Allow new domains that are clearly ordinary businesses
- Fewer false blocks, so the policy stays switched on
The same logic underpins category-based policies in general. See malware and phishing protection and DNS filtering security for how teams apply it.
Why brand teams want them
For brand protection, the question is not "is this domain dangerous" but "is someone using my name". New registrations are the earliest place to spot that.
| Pattern | What it looks like | Why it matters |
|---|---|---|
| Typosquatting | One letter missing, doubled or swapped in a brand name | Catches users who mistype the address |
| Combosquatting | Brand plus a word such as "login", "support" or "sale" | Looks official in emails and ads |
| Lookalike characters | Letters from other alphabets that look the same | Very hard to spot by eye |
| New endings | The brand name under an ending the company does not own | Can host fake shops or counterfeit goods |
| Campaign hijacking | Domains that echo a product launch or promotion | Rides on paid marketing the brand already did |
How categorizing new domains works, from the outside
We do not publish how classification is done. What matters to buyers is what comes out, and how the output changes as a new site grows.
Same categories
New domains get the same 59 web filtering categories and IAB v2 and v3 tiers as the rest of the database, so one policy covers old and new sites.
From site content
Categories are assigned from the content the site shows, then reviewed and validated in regular checks. No content means no guessed category.
Checked again
Each new domain is checked again after a week and after a month, because many sites only add content after launch.
Parked is a category
Parked and for-sale domains get their own category. Across the whole database that is close to 600,000 domains.
| State of a new domain | What the feed shows | Suggested policy |
|---|---|---|
| Clear content, ordinary topic | Categorized for example Business or Food & Drink | Allow, or apply normal category rules |
| Clear content, risky topic | Categorized for example Gambling or Malware / Phishing / Suspicious | Block at once |
| Parking or for-sale page | Parked Parked / For-Sale Domains | Block or watch, depending on risk appetite |
| No content yet | Pending checked again later | Treat as unknown NRD until the next check |
| Content changes after launch | Updated in the next daily delta | Policy follows the new category |
What a newly registered domains feed can contain
A raw NRD list is just names and dates. A categorized feed adds the fields that make the names useful. Columns can be chosen per customer.
Domain and dates
The domain name, when it first appeared in the feed and when it was last checked.
Categories
Web filtering categories and IAB tiers, once the site shows enough content to categorize.
Status
Whether the domain has content, is parked or is still waiting for its next check.
Country
The country a site serves, where its content makes that clear.
Change marker
Whether the row is new today or an update to a domain sent before.
Domain ending
Handy for policies that treat some endings with more caution than others.
Who uses a newly registered domains list
Security vendors
DNS filters, secure gateways and email security products that need categories for brand-new domains, not only for known ones.
Enterprise SOC teams
Threat hunting in DNS and proxy logs, where a hit on a days-old domain deserves a closer look. See cybersecurity threat intelligence.
Brand protection
Watching new registrations for brand names and lookalikes, then sorting matches by what the site actually shows.
ISPs and telecoms
Network-level protection for subscribers, where new risky domains need cover before reports arrive. See telecom carrier services.
Ad quality teams
Spotting fresh domains in bid requests, a common sign of spoofing and low-quality supply. See ad fraud prevention.
Market researchers
Counting new shops, start-ups or AI tools by category and country, as an early signal of where activity is growing.
Designing an NRD policy
If you are adding new domain data to a filter or a detection rule, a few choices decide whether the policy works or gets switched off after a week.
| Decision | Common choice | Things to weigh |
|---|---|---|
| Age window | 30 days | Shorter windows mean fewer false blocks; longer windows catch slower campaigns |
| Risky categories | Block at once | Phishing, malware, gambling and adult for most networks |
| No content yet | Warn or isolate | A hard block is safest, a warning page is friendlier |
| Ordinary categories | Allow | Keeps new suppliers and campaign sites working |
| Exceptions | Allow list per team | Marketing and procurement often need new domains first |
| Logging | Log every NRD hit | Useful for hunting even when the domain is allowed |
Raw NRD lists versus a categorized feed
Lists of new domain names are easy to find. What they lack is any judgement about the names. That is the gap a categorized feed fills.
| Question | Raw list of new names | Categorized NRD feed |
|---|---|---|
| What is on the site? | Unknown | Categories once content appears |
| Is it parked? | Unknown | Marked as parked or for sale |
| Did it change after launch? | Not tracked | Checked again after a week and a month |
| Which country does it serve? | Unknown | Set where content makes it clear |
| Can one policy cover old and new sites? | No, separate logic needed | Yes, same categories as the full database |
| Typical use | Block everything new | Block, watch or allow by category |
Adding the feed to your stack
Most teams load the daily file into the same place as the main category data. The steps are short.
Pick up the daily delta
Fetch the new file each day at a fixed time and keep the previous files for a few weeks, in case you need to replay a day.
Upsert by domain
Insert new domains and overwrite existing rows that changed. The domain is the key, so the load is simple and repeatable.
Apply the policy
Map categories to actions: block, warn, isolate or allow. Treat pending domains as unknown until their next check.
Age out
When a domain passes your NRD window, drop the extra caution and let the normal category rule apply.
Review hits
Look at which new domains your users touched. Patterns in those hits are often the first sign of a campaign aimed at your organisation.
Honest limits of any NRD data
New domains are the hardest part of the web to label, and no feed sees everything perfectly. These are the limits to plan for, and they apply to every source of new domain data.
Empty sites stay unknown
A domain with no content cannot be categorized. Your policy needs a rule for unknown domains, whatever feed you use.
Content can change fast
A harmless page can be swapped for a harmful one. Short windows between checks help, but layered defences still matter.
Not every new name resolves
Many registrations never become websites at all. They are held for resale, kept for brand defence or simply left unused.
Old domains can be risky too
Expired domains bought by new owners and hacked older sites fall outside the NRD window. Regular refreshes of the full database cover those.
Who registers new domains
A day of new registrations is a mix of very different owners. Knowing the mix explains why a single block-everything rule is such a blunt tool.
New businesses
Shops, agencies, trades and start-ups launching their first site. These are the domains a blanket NRD block hurts most.
Existing companies
Campaign sites, product launches, country editions and defensive registrations of their own brand names.
Individuals
Personal blogs, portfolios, wedding pages and hobby projects, many of which stay small.
Domain investors
Names bought for resale. They usually show a parking or for-sale page for a long time.
Abusers
Phishing, scam and malware operators. A small share of the total, but the reason NRD data exists.
NRD feed versus the full database
Many buyers take both. They solve different parts of the same problem: the full database covers the sites people already visit, and the feed covers the sites that did not exist last week. Together they leave very few domains without a category, whichever site a user, a bid request or an email link points to.
Full category database
- Over 100 million categorized domains
- Covers the sites people actually visit
- Regular refreshes of existing domains
- Base for policies, targeting and research
Newly registered domains feed
- About 300,000 new domains a day
- Covers the newest, least known part of the web
- Checks after a week and after a month
- Base for early detection and brand watching
Newly registered domains: questions
What is a newly registered domain?
A newly registered domain, or NRD, is a domain name that was registered recently, usually within the last 30 days. Security tools often treat such domains with extra caution for a period after registration.
Why do security teams block newly registered domains?
Phishing, malware and scam campaigns often use domains that are only days old, before they appear on any blocklist. Blocking or flagging new domains for a short window reduces that risk.
How many domains are registered every day?
Across all domain endings, hundreds of thousands of new domains are registered on a typical day. Our feed categorizes about 300,000 newly registered domains every day.
Why categorize new domains instead of blocking all of them?
Most new domains are legitimate: new shops, projects and company sites. Categories let you block risky ones, watch unknown ones and allow clearly harmless ones, instead of blocking everything.
Why are new domains checked again later?
Many new sites have no content on day one. Each domain is checked again after a week and after a month, because many sites only add content after launch.
How is the feed delivered?
As daily delta files in CSV, JSON or Parquet, so you only load the domains that are new or changed.
Is every newly registered domain dangerous?
No. The large majority are ordinary: new businesses, personal projects, event pages and brand registrations. The risk is that the dangerous minority hides among them.
What age window should I use?
Thirty days is the most common choice. Some teams use a shorter window for blocking and a longer one for logging and hunting.
Can I get only certain endings or countries?
Yes. The feed can be limited to selected domain endings, countries or categories, for example only new shopping domains for a fraud team.
Can I check a single new domain?
Yes. Use the domain checker, or read about single and bulk checks on website category lookup.
Talk to us about a newly registered domains feed
Tell us your use case, the columns you need and how the feed should arrive. We will propose a feed and a licence that fit.
Talk to us about an NRD feed Explore the database