Choosing a Discovery Feed
Newly Observed Domains (NOD), Newly Active Domains (NAD), Newly Observed Hostnames (NOH), and Domain Discovery are the discovery Threat Feeds. They report new domain and hostname activity, but each feed has different inclusion criteria. Use this page to choose the feed that matches your workflow. For API reference, authentication, and response formats, see each feed’s page.
Choose a feed
Section titled “Choose a feed”Start with the result you need, then choose based on the event you want to detect.
NOH returns hostname and subdomain observations. The other discovery feeds return apex domains.
If your workflow needs more than one of these events, subscribe to more than one feed. For example, Domain Discovery can provide broad coverage of newly registered and newly observed domains, while NOH can identify newly observed hostnames.
Compare discovery feeds
Section titled “Compare discovery feeds”| Feed | Returns | Included when | Choose it when you need |
|---|---|---|---|
| NOD | Apex domains, such as example.com | An apex domain is observed by our Domain Name System (DNS) sensor network for the first time | First observations of apex domains |
| NAD | Apex domains | An apex domain is newly active for the first time or after at least 10 days without observation by our DNS sensor network | First observations and domain reactivations |
| NOH | Fully qualified domain name (FQDN), such as clickme.example.com | An FQDN is observed by our DNS sensor network for the first time | Hostname- and subdomain-level detection |
| Domain Discovery | Apex domains | A domain is newly registered or observed by our DNS sensor network | Newly registered domains before they resolve in DNS, plus newly observed domains |
Feed relationships
Section titled “Feed relationships”- NOD is included in NAD. An apex domain first observed by our DNS sensor network meets NAD’s first-time newly active criterion. Choose NAD if you also need domains that become active after a period of inactivity.
- NOH uses a different level of detail. NOH returns full hostnames, while NOD, NAD, and Domain Discovery return apex domains. Use NOH when a subdomain such as
clickme.example.commatters to your workflow. - Domain Discovery has different inclusion criteria. It includes newly registered and newly observed apex domains. Use it when you need broad coverage of new domain registrations and DNS sensor network observations.
Choose more than one feed
Section titled “Choose more than one feed”Use NOD and NAD together only when you need separate handling for first observations and reactivations. NAD already includes domains that are newly active for the first time.
You can combine Domain Discovery with a feed that uses DNS sensor network observations when you need both registration coverage and observations. Combine NOH with an apex-domain feed when you also need hostname-level detail.