Every subdomain first seen yesterday, in one batch.
Every subdomain identified for the first time in the previous 24 hours. The first-observed slice of Deepinfo's subdomain corpus, delivered as a daily batch.
One row per newly observed subdomain.
The Daily Discovered Subdomains Feed surfaces every fully qualified subdomain that crossed Deepinfo's discovery threshold in the past 24 hours. Each record is a hostname seen for the first time across the four discovery surfaces, deduplicated against the existing corpus.
Discovery sources include passive DNS partnerships, active scanning, certificate transparency logs across all major operators, and web crawling. A subdomain enters the daily file when its first observation falls within the snapshot window, regardless of which surface first surfaced it.
This is the right feed for catching new infrastructure as it appears: staging environments published prematurely, marketing landing pages spun up for campaigns, SaaS-tenant subdomains created by your customers, and the first wave of observation on freshly registered apex domains.
Daily batch, delivered as a download.
A single API call returns the metadata for the day's snapshot. Authenticate with an API token scoped to the feed.
Delivery
Bulk download. The API call returns metadata plus a signed download_url. HTTPS, S3, or SFTP.
Format
JSON or CSV. The response reports format, file size, line count, and last update timestamp.
Refresh cadence
Daily. Built once per day against the previous 24 hours of new observations.
Authentication
API token in the request header. Per-feed scoping. Reference at docs.deepinfo.com.
What you actually get.
The API response, with the metadata for the latest daily batch:
{
"download_url": "https://feeds.deepinfo.com/daily-discovered-subdomains/2026-05-02/daily-discovered-subdomains.json.gz?...",
"file_format": "json",
"file_size": 92847391,
"file_update_time": "2026-05-02T03:14:27Z",
"line_count": 4192847
}A few representative lines from the JSON-formatted file at download_url:
{"fqdn":"staging-v2.acme.com"}
{"fqdn":"campaign-q2-launch.contoso.io"}
{"fqdn":"customer-portal-eu.example.shop"}
{"fqdn":"newhire-onboarding.deepinfo.com"}
{"fqdn":"api-canary.brand-x.dev"}Workflows this feed powers directly.
Attack Surface Management
Catch new subdomains under your apex domains the day they appear. Forgotten staging environments are usually first-observed entries.
Read the use casePhishing Detection and Prevention
Detect new lookalike-host subdomains under registered lookalike domains. Catches the host rotation that follows the registration.
Read the use caseData Leak Detection
Surface freshly published environments that may expose data before lockdown. The first-observed window is when misconfigurations are most likely.
Read the use case“First-observation signal at end-of-day batch cadence drives our anomaly detection. New subdomains under customer apexes are the leading indicator we tune most of our alerting against.”
Other daily feeds.
Every domain dropped yesterday, in one batch.
Every domain name deleted, expired, or dropped from registration in the previous 24 hours.
See feed DATA FEEDEvery domain registered yesterday, in one batch.
Every domain name registered in the previous 24 hours across all monitored TLDs.
See feed DATA FEEDEvery domain that changed yesterday, in one batch.
Every domain name with Whois or DNS changes in the previous 24 hours.
See feedWatch new infrastructure appear at internet scale.
We'll set up token access and walk through how teams plug this feed into ASM and brand-protection workflows.