# Daily Discovered Subdomains Feed

URL: https://www.deepinfo.com/data-api/feeds/daily-discovered-subdomains/

## New Hostnames in the Index Arrive in One File a Day.

The Daily Discovered Subdomains Feed delivers the subdomains Deepinfo discovered in the last day, so your team can filter for its own domains and see what appeared. Staging hosts, campaign sites and tools stood up outside the usual process all get a hostname.

[Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Daily Discovered Subdomains reference](https://docs.deepinfo.com/reference/feeds/daily-discovered-subdomains/)

### Pull the Last Day’s Discoveries With One Request.

Ask for CSV or JSON. The metadata tells your job how big the file is and when it was built before anything is downloaded.

GET `https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains` [Reference](https://docs.deepinfo.com/reference/feeds/daily-discovered-subdomains/)

| Parameter | Type |  | Description |
| --- | --- | --- | --- |
| `file_format` | string | Optional | `json` (default) or `csv`. |

Request

curl:

```bash
curl "https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains?file_format=json" \
  -H "apikey: YOUR_API_KEY"
```

Python:

```python
import requests

meta = requests.get(
    "https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains",
    params={"file_format": "json"},
    headers={"apikey": "YOUR_API_KEY"},
).json()
print(meta["file_update_time"], meta["file_size"])
```

JavaScript:

```javascript
const r = await fetch(
  'https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains?file_format=json',
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const { download_url, file_update_time } = await r.json()
```

Response

200 OK · application/json

```json
{
  "download_url": "https://…/<pre-signed link, valid for 1 hour>",
  "file_format": "json",
  "file_size": …,
  "file_update_time": "2026-09-22T10:00:00Z",
  "line_count": …
}
```

### Keep Only the Hostnames Under Your Names.

Most of the file belongs to other organizations. Filter it by suffix against the apex domains you own, and the remainder is the list your team should look at.

A match is not automatically a problem. Resolve it with [DNS Lookup](https://www.deepinfo.com/data-api/apis/dns-lookup/), check what it serves with [Web Data](https://www.deepinfo.com/data-api/apis/webdata-lookup/), then add it to your inventory or ask who built it.

Shell

```bash
# our-apexes.txt: one apex per line, e.g. acme.example
# Checks every CSV field, so no column layout is assumed.
awk -F',' '
  NR == FNR { sfx["." tolower($1)]; next }
  { for (i = 1; i <= NF; i++) {
      h = tolower($i); gsub(/"/, "", h)
      for (s in sfx) {
        n = length(h) - length(s)
        if (n > 0 && substr(h, n + 1) == s) print h
      }
  } }
' our-apexes.txt discovered.csv | sort -u > ours.txt
```

Discovered means *new to the index*, not necessarily new on the internet.

A hostname can be live for a long time before it is first observed. The day it appears in the file dates when Deepinfo first recorded it, which is the useful signal for a team comparing the index with its own inventory.

### Workflows That Start With a New Hostname.

#### [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/)

Review new hostnames under your domains before they sit unowned for a year.

#### [Subsidiary Oversight](https://www.deepinfo.com/solutions/use-cases/subsidiary-oversight/)

Run this filter with each group company’s apex domains and see which entity is adding infrastructure.

#### [Phishing Detection](https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/)

Watch for new hosts under lookalike domains you already track, a sign the infrastructure is being prepared.

#### [Data Leak Detection](https://www.deepinfo.com/solutions/use-cases/data-leak-detection/)

Check new staging and test hosts for exposed content before someone else finds them.

### Other Ways to Track New Hosts.

- [Asset Discovery](https://www.deepinfo.com/platform/easm/smart-asset-discovery/) (EASM): External Attack Surface Management proposes new assets for your team to approve and can notify on each one.
- [All Subdomains](https://www.deepinfo.com/data-api/feeds/all-subdomains/) (Full file): All subdomains in the index, in one file.
- [Subdomain Finder](https://www.deepinfo.com/data-api/apis/subdomain-finder/) (API): All known subdomains of one domain, as full records.

### Questions About Daily Discovered Subdomains Feed

**What does “the last day” mean for this file?**

It is counted back from the `file_update_time` in the response. Store that timestamp with each run so consecutive files line up in your pipeline.

**Is there a real-time version?**

Not as a public endpoint. [Real-time discovered subdomains](https://www.deepinfo.com/data-api/feeds/real-time-newly-discovered-subdomains-stream/) compares the routes that exist today, including discovery on your own domains.

**Can we check for a new file without requesting a link?**

Yes. `GET /feeds/latest` lists each feed’s files with their format, size, line count and update time, and creates no download link.

**How is the daily feed priced?**

Data feeds are priced on their own, by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing).

**Can we use the file inside our own product?**

How the data can be used and shown in your product is part of the agreement. [Talk to the data team](https://www.deepinfo.com/contact/?topic=data-api) about your case.

### See the Hostnames Appearing Under Your Name.

We set up access to the daily feed, or show your team how the Deepinfo Platform discovers and monitors new assets on your own domains.

[Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [Request demo](https://www.deepinfo.com/request-demo/)