Domain registrations as they happen.
Domain registrations delivered as they occur, with minimal delay. The same upstream signals as the daily batch, streamed continuously instead of bundled at end-of-day.
One event per registration, streamed continuously.
The Real-time Newly Registered Domain Names Stream is the daily registered feed, delivered as it happens instead of bundled. Each new registration becomes an event on the stream within minutes of registry observation, end-to-end.
Sources match the daily feed: registry zone-file changes where Deepinfo has visibility, ICANN CZDS for gTLDs, ccTLD partner integrations, and Deepinfo's own continuous discovery pipeline. The stream is the same data, denormalized to one event per record.
This is the right input for systems that act on registration signal in minutes rather than hours: phishing-defense pipelines that want to score and route lookalikes before the campaign launches, takedown automation that escalates on impersonation, and any analytics workflow that benefits from low-latency observation.
Streamed, not batched.
Events are delivered through a managed stream endpoint. Authenticate with an API token scoped to the stream.
Delivery
Real-time stream. Events are delivered as JSON messages over a managed stream endpoint, with backpressure-aware buffering. Existing customers can configure delivery to Kafka, Kinesis, or Webhook.
Format
JSON. One event per record. Schema matches the daily feed file format.
Refresh cadence
Continuous. Events appear on the stream within minutes of underlying registry observation.
Authentication
API token in the request header. Per-stream scoping; rotate from the dashboard. Reference at docs.deepinfo.com.
What you actually get.
Representative stream events:
{"event":"registered","domain":"new-customer-portal.com","observed_at":"2026-05-02T14:23:08Z","source":"czds","tld":"com"}
{"event":"registered","domain":"acmebrand-secure-login.net","observed_at":"2026-05-02T14:23:11Z","source":"czds","tld":"net"}
{"event":"registered","domain":"verify-account-update.io","observed_at":"2026-05-02T14:23:14Z","source":"partner","tld":"io"}
{"event":"registered","domain":"shopdomain.shop","observed_at":"2026-05-02T14:23:17Z","source":"czds","tld":"shop"}
{"event":"registered","domain":"my-fresh-startup.co","observed_at":"2026-05-02T14:23:21Z","source":"partner","tld":"co"}Workflows this stream powers directly.
Phishing Detection and Prevention
Score and route lookalike registrations before campaigns launch. Latency from registration to detection is the key variable.
Read the use caseBrand Impersonation Protection
Catch impersonating registrations as they happen, not at end-of-day. The first-mover advantage on takedown is real.
Read the use caseThreat Intelligence Operations
Pipe registration events into SOC, IR, or CTI workflows for real-time hunting and correlation.
Read the use case“Real-time registration events feed directly into our domain-watchlist matcher. Catching new registrations at observation time, instead of next-day batch, cuts the customer-impersonation window from hours to minutes.”
Get registrations as they happen.
We'll set up token access and discuss delivery patterns to fit your stack: stream endpoint, Webhook, Kafka, or Kinesis.