New subdomains the moment they're observed.
Subdomains delivered the moment they are first observed. The daily discovered subdomains feed, streamed continuously for systems that act on first-observation signal.
One event per subdomain, streamed continuously.
The Real-time Newly Discovered Subdomains Stream is the first-observed slice of the subdomain corpus, delivered as it happens. Each newly observed fully qualified subdomain becomes an event on the stream within minutes of crossing Deepinfo's discovery threshold.
Sources match the daily feed: passive DNS partnerships, active scanning, certificate transparency logs across all major operators, and web crawling. The stream is the same data, denormalized to one event per record, with the discovery surface annotated on each event.
This is the right input for ASM and DSI workflows that need to act on new infrastructure within minutes: catching staging environments published prematurely, marketing pages spun up for campaigns, or first-wave observation on freshly registered apex domains.
Streamed, not batched.
Events are delivered through a managed stream endpoint. Authenticate with an API token scoped to the stream.
Delivery
Real-time stream. JSON messages over a managed endpoint; backpressure-aware buffering. Optional Webhook, Kafka, or Kinesis routing.
Format
JSON. One event per subdomain, with the discovery surface annotated on the event.
Refresh cadence
Continuous. Events appear within minutes of first observation.
Authentication
API token in the request header. Per-stream scoping. Reference at docs.deepinfo.com.
What you actually get.
Representative stream events:
{"event":"discovered","fqdn":"staging-v2.acme.com","source":"passive_dns","first_seen_at":"2026-05-02T14:23:08Z"}
{"event":"discovered","fqdn":"campaign-q2-launch.contoso.io","source":"ct_log","first_seen_at":"2026-05-02T14:23:14Z"}
{"event":"discovered","fqdn":"customer-portal-eu.example.shop","source":"web_crawl","first_seen_at":"2026-05-02T14:23:21Z"}
{"event":"discovered","fqdn":"newhire-onboarding.deepinfo.com","source":"active_scan","first_seen_at":"2026-05-02T14:23:27Z"}
{"event":"discovered","fqdn":"api-canary.brand-x.dev","source":"ct_log","first_seen_at":"2026-05-02T14:23:33Z"}Workflows this stream powers directly.
Attack Surface Management
Catch new subdomains under your apex domains within minutes. The first-observed window is when misconfigurations are most likely.
Read the use casePhishing Detection and Prevention
Detect new lookalike-host subdomains under known impersonating registrations as the host rotation happens.
Read the use caseData Leak Detection
React to freshly published staging environments before they get locked down. The latency between publish and discovery is the working window.
Read the use case“The streaming version of new-subdomain signal is what made automated detection viable for us. Sub-minute latency from observation to our SIEM beats the daily-batch alternative for time-sensitive alerts.”
Watch subdomain discovery at stream latency.
We'll set up token access and discuss delivery patterns for ASM and DSI workflows.