DOdomaintools
Newly Active Domains Feed

Returns data from the Newly Active Domains (NAD) feed.

Apex-level domains (e.g. example.com`` but not www.example.com`) that we observe based on the latest lifecycle of the domain. A domain may be seen either for the first time ever, or again after at least 10 days of inactivity. Populated with our global passive DNS (pDNS) sensor network.

get/v1/feed/nad/

Request

Query parameters

domainstring

A domain name or substring using the DNS character set (letters, digits, hyphens).

An asterisk (*) may be used as a wildcard prefix or suffix, but not in the middle. Omit the parameter entirely to fetch all domains.

A trailing dot is acceptable. International characters must be in punycode.

Filter for an exact domain or a domain substring by prefixing or suffixing your string with *.

Multiple parameters are supported: e.g., ?domain=*apple*&domain=*mic*.

The URL-encoded version of * (%2A) may be required in some clients.

See full documentation.

integer

Relative offset in seconds before the current UTC time. The query window covers the most recent 5 days, from -1 (1 second ago) to -432000 (5 days ago). A value older than -432000 places the window entirely outside it, and the response contains no records.

OR
string date-time

ISO 8601 datetime in strict UTC format with no milliseconds or timezone offset. Format: YYYY-MM-DDTHH:MM:SSZ.

The query window covers the most recent 5 days. A timestamp older than 5 days places the window entirely outside it, and the response contains no records.

Returns results observed from the earliest available record up to the specified point in time (inclusive).

Use with after to return results from a specific window, starting from the after time (inclusive) and ending at the before time (inclusive).

At least one of after, before, or sessionID must be provided to establish a valid query window. If after is omitted, before (or sessionID) becomes required, and vice versa.

integer

Relative offset in seconds before the current UTC time.

The query window covers the most recent 5 days, from -1 (1 second ago) to -432000 (5 days ago). A value older than -432000 is capped to the start of that window, and the response begins 5 days back.

OR
string date-time

ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: YYYY-MM-DDTHH:MM:SSZ.

The query window covers the most recent 5 days. A timestamp older than 5 days is capped to the start of that window, and the response begins 5 days back.

Returns results observed from the specified point in time (inclusive) up to the latest available record.

Use with before to return results from a specific window, starting from the after time (inclusive) and ending at the before time (inclusive).

At least one of after, before, or sessionID must be provided to establish a valid query window. If before is omitted, after (or sessionID) becomes required, and vice versa.

headersboolean

Optional flag to include a header row as the first line of the response when the response format is text/csv.

Set to 1 to enable CSV headers. If omitted, no header row is included.

Accepts true, false, 1, or 0; false is the default. Enabling it on a request that doesn't ask for text/csv returns 422, as does a value that isn't a boolean.

Adds a header row as the first line of the response when text/csv is requested.

Set headers=1 to enable. Enabling it on a request that doesn't ask for text/csv returns 422.

sessionIDstring

Unique, client-generated session identifier for incremental feed retrieval.

Requirements:

  • 1 to 64 characters in length

  • Alphanumeric characters and hyphens only

  • Case-sensitive

Use a new value to start a new session; reuse the same value to resume a session and fetch additional results.

If omitted, time window parameters (such as after/before) are required.

Example:mySOC

A string that serves as a unique identifier for the session, used for resuming data retrieval from the last point.

Use a new sessionID to begin a new session, fetching the most recent hour by default. Add fromBeginning=true on only the first request to start from the earliest available hour instead.

Reuse the same sessionID to return all feed data since your last request.

If an API call returns an HTTP 206 response, repeat the same request with the same sessionID to receive the next tranche of results, until an HTTP 200 response is returned, indicating all results have been delivered.

If omitted, time window parameters (such as after/before) are required.

fromBeginningboolean

Optional flag to return data from the start of the available window (the first hour) when beginning a new session. Requires sessionID.

Accepts true, false, 1, or 0; false is the default. Only use on the first request with a new session ID — a session ID that already exists returns 406. A value that isn't a boolean returns 422, as does use without a sessionID.

Requires sessionID. When starting a new session, set fromBeginning=true to fetch data from the earliest available time (the first hour) rather than the most recent hour.

Returns 406 if the given sessionID already exists. Drop fromBeginning from subsequent requests after the first call.

topinteger

Maximum number of feed entries to return in the response payload.

Primarily intended for testing.

Limits the number of results in the response payload. Primarily for testing.

api_usernamestring

Only required for HMAC authentication.

Your DomainTools API username.

signaturestring

Hex-encoded HMAC signature computed over the string api_username + timestamp + request_path using the API key and a supported algorithm (MD5, SHA1, or SHA256) as the HMAC secret. For example, if using SHA256, compute:

hex(HMAC_SHA256(api_key, api_username + timestamp + "/v1/feed/nad/"))

and pass that as ?signature=….

timestampstring

Only required for HMAC authentication.

Current UTC timestamp in ISO 8601 format (YYYY-MM-DDTHH:MM:SSZ). Used to prevent replay attacks; the server will reject timestamps outside an allowed window.

app_partnerstring

Your product or integration name.

app_namestring

Appliance/module/playbook name

app_versionstring

Your product or integration version.

Response

OK

Changes

No recorded changes to this operation across all 1 revision of this API.