Daily Discovered Subdomains Feed
New Hostnames in the Index Arrive in One File a Day.
Staging hosts, campaign sites and tools stood up outside the usual process all get a hostname. This feed delivers the subdomains Deepinfo discovered in the last day, so your team can filter for its own domains and see what appeared.
Request
GET /
daily-discovered-subdomains
Filter by suffix our-apexes.txt, acme.example
cdn7.northwind.example(not under your names)promo.acme.example (under your names, not in your inventory)
: add to inventory
mail.harbor-cafe.example(not under your names)test-api.acme.example (under your names, not in your inventory)
: ask who built it
Then
resolve (DNS Lookup), check what it serves (Web Data)
first recorded by Deepinfo, not necessarily new on the internet
Pull the Last Day’s Discoveries With One Request.
Ask for CSV or JSON. The metadata tells your job how big the file is and when it was built before anything is downloaded.
| Parameter | Type | Description | |
|---|---|---|---|
file_ | string | Optional | json (default) or csv. |
Request
curl "https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains?file_format=json" \
-H "apikey: YOUR_API_KEY"import requests
meta = requests.get(
"https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains",
params={"file_format": "json"},
headers={"apikey": "YOUR_API_KEY"},
).json()
print(meta["file_update_time"], meta["file_size"])const r = await fetch(
'https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains?file_format=json',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
const { download_url, file_update_time } = await r.json()Response
{
"download_url": "https://…/<pre-signed link, valid for 1 hour>",
"file_format": "json",
"file_size": …,
"file_update_time": "2026-09-22T10:00:00Z",
"line_count": …
}Keep Only the Hostnames Under Your Names.
Most of the file belongs to other organizations. Filter it by suffix against the apex domains you own, and the remainder is the list your team should look at.
A match is not automatically a problem. Resolve it with DNS Lookup, check what it serves with Web Data, then add it to your inventory or ask who built it.
# our-apexes.txt: one apex per line, e.g. acme.example
# Checks every CSV field, so no column layout is assumed.
awk -F',' '
NR == FNR { sfx["." tolower($1)]; next }
{ for (i = 1; i <= NF; i++) {
h = tolower($i); gsub(/"/, "", h)
for (s in sfx) {
n = length(h) - length(s)
if (n > 0 && substr(h, n + 1) == s) print h
}
} }
' our-apexes.txt discovered.csv | sort -u > ours.txtDiscovered means new to the index, not necessarily new on the internet.
A hostname can be live for a long time before it is first observed. The day it appears in the file dates when Deepinfo first recorded it, which is the useful signal for a team comparing the index with its own inventory.
- live
- first recorded
- in the daily file
Workflows That Start With a New Hostname.
Attack Surface Management
Review new hostnames under your domains before they sit unowned for a year.
Subsidiary Oversight
Run this filter with each group company’s apex domains and see which entity is adding infrastructure.
Phishing Detection
Watch for new hosts under lookalike domains you already track, a sign the infrastructure is being prepared.
Data Leak Detection
Check new staging and test hosts for exposed content before someone else finds them.
Questions About Daily Discovered Subdomains Feed
What does “the last day” mean for this file?
It is counted back from the file_ in the response. Store that timestamp with each run so consecutive files line up in your pipeline.
Is there a real-time version?
Not as a public endpoint. Real-time discovered subdomains compares the routes that exist today, including discovery on your own domains.
Can we check for a new file without requesting a link?
Yes. GET / lists each feed’s files with their format, size, line count and update time, and creates no download link.
How is the daily feed priced?
Data feeds are priced on their own, by volume and frequency, separately from the platform. See Data & API pricing.
Can we use the file inside our own product?
How the data can be used and shown in your product is part of the agreement. Talk to the data team about your case.
See the Hostnames Appearing Under Your Name.
We set up access to the daily feed, or show your team how the Deepinfo Platform discovers and monitors new assets on your own domains.