New Domain Hunter

Hunting New Registered Domains is an open-source Python tool available on GitHub that automates the monitoring and analysis of newly registered domains for suspicious patterns, brand abuse, typosquatting, and phishing infrastructure. It retrieves daily newly registered domain feeds and applies detection rules to flag domains matching configured threat patterns.

For OSINT investigators and threat intelligence analysts, newly registered domain monitoring is a proactive intelligence capability — identifying malicious domains before they are weaponized, or immediately after deployment, provides a tactical advantage over reactive detection. Many phishing campaigns, brand impersonation attacks, and credential harvesting operations use domains registered within days of attack launch.

The tool's pattern matching capabilities allow investigators to monitor for: domains containing a target brand name or common misspellings (typosquatting), domains using lookalike characters in international alphabets (homograph attacks), domains following naming patterns consistent with known threat actor infrastructure, and domains registered in combinations suggesting fraudulent intent (company-name-login.com, company-name-verify.com patterns).

Daily monitoring of newly registered domains relevant to a protected brand allows brand protection teams to proactively identify and take down impersonating domains before victims reach them. For financial institutions, law firms, and other high-phishing-risk organizations, this proactive monitoring significantly reduces the harm from phishing campaigns.

The tool outputs discovered suspicious domains with registration timestamps, registrar data, and name servers, allowing investigators to prioritize domains for immediate investigation and potential takedown action.

Integration with threat intelligence platforms and security tooling is supported through its configurable output formats, enabling new domain alerts to automatically populate watchlists and detection rules.

Installation requires Python 3 and a source for newly registered domain feeds (several free sources are supported). Configure pattern rules based on protected brands and known threat actor naming conventions. Run daily against fresh domain registration feeds for continuous monitoring coverage.

Document all configuration rules, detection logic, and flagged domains with registration dates for case records.