Skip to main content

How to Monitor New Domain Registrations for Brand Abuse

How to Monitor New Domain Registrations for Brand Abuse

Your brand gets phished before the email is sent. Attackers register paypa1-secure.com, microsft-verify.net, or yourbrand-support.io and wait 48 hours so new-domain blocks expire. By the time the abuse is reported, the domain has already served a kit. Monitoring at registration flips that timeline — you see the lookalike the day it appears, with DNS and hosting context to decide block, monitor, or takedown.

At Primitive Host we see this daily across 276M+ domains: the cheapest remediation is a block on day zero, not an incident on day three. This guide shows a practical workflow SOC and brand-protection teams actually run.

Why registration-time monitoring beats blacklists

Blacklists answer “is this domain already flagged?” Registration monitoring answers “does this domain look like it will be abused?” A blacklist hits after the phishing email; a watchlist hits after the CREATE in the zone file. Both matter, but the second gives you hours of lead time.

Check any suspect with our free domain blacklist checker — it queries 12 real-time DNSBLs. If it is clean but two hours old and sharing hosting with known abuse, you still want to block it.

Step 1 — Define what to watch

Start with three lists:

  1. Exact brand keywords — acme, acme-pay, acmemedical. Keep it to 5-15 terms; broader lists create noise.
  2. Homoglyphs and typos — acme → acrne, acm3, acme-secure. Include hyphen and keyword additions like login, verify, support. The same logic powers our Malicious & Typosquatted Domain Alerts.
  3. TLD scope — prioritize com, net, org, io, co, plus the abused new gTLDs (top, xyz, shop, online). You can scan all 5,625+ TLDs in Primitive Host, but start with your customers’ footprint.

Document the list in a single watchlist.txt so the API query stays consistent.

Step 2 — Pull daily new registrations

Primitive Host publishes newly registered domains daily. Two paths:

No-code preview: browse /lists/<tld>/ and download 100-row samples. Useful for ad-hoc hunts.

Automated feed: query the Domain Intelligence API for the delta:

curl -H "Authorization: Bearer $PRIMITIVE_TOKEN" \
  "https://primitive.host/api/v1/zones/com/dl/2026-09-06" | head

# Or search across TLDs for new brand hits
curl -H "Authorization: Bearer $PRIMITIVE_TOKEN" \
  "https://primitive.host/api/v1/domains?contains=acme&registered_since=2026-09-05&limit=500"

For a nightly job, pull the last 24h across your TLD slice, then filter locally:

import re

watch = [re.compile(pat, re.I) for pat in [r"acme", r"acrne", r"acm3", r"acme[-_]?secure"]]
hits = [d for d in new_domains if any(rx.search(d["domain"]) for rx in watch)]

Store hits with first-seen timestamp, TLD, and name server — you will need the latter for scoring.

Step 3 — Score and triage in minutes, not hours

Not every match is malicious. Score on three cheap signals before a human looks:

  • Age: <7 days is high signal. New registrations that also set up MX or a login form are prioritized.
  • DNS & hosting: shared hosting with known abuse ASNs, privacy-protected name servers that flip on day zero, or fast A-record churn.
  • Lexical distance: Levenshtein 1-2 from brand plus an action word (secure, verify) outranks a distant fuzzy match.

In practice a SOC creates three buckets: Block now (phishing kit path or homoglyph+new+abuse host), Monitor (new + brand keyword, no kit yet), Ignore (old domain, no DNS change). The goal is to auto-block bucket one and ticket bucket two.

Pair this with risk context from What Public Conversations Can Tell You About Emerging Threats and Brand Abuse Detection Domains That Matter for additional lexical signals.

Step 4 — Alert and operationalize

Wire the feed where your team already works:

  • SIEM/SOAR: POST hits to Splunk/Sentinel or create a Jira/Slack alert via webhook. Include domain, first-seen, DNS snapshot, and score.
  • Preventive blocks: push Block now hits to your secure web gateway, email filter, and DNS firewall before the first phish is sent.
  • Takedown queue: for Monitor hits that go live, capture screenshot and WHOIS, then file registrar/registry abuse. Early evidence speeds takedowns from days to hours.

Track precision weekly: phishing-confirmed / total alerted. Tune watchlist terms that alert but never convert.

What not to do

  • Don’t rely on regex alone — you will miss homoglyphs. Use a typosquat-aware list.
  • Don’t watch only com — 40% of brand abuse in our data uses new gTLDs because they are cheap and less monitored.
  • Don’t wait for user reports — that is the most expensive detection path.

FAQ

How fast are alerts after registration? Ingestion is daily; high-risk brand matches are available the same day the domain appears in the zone. Poll nightly for best coverage, or hourly via the API delta.

How is this different from typosquatting detection? Typosquatting detection is the pattern (swapped letters, homoglyphs). Registration monitoring is the feed that runs that pattern every day and delivers the hits. They work together.

Can I monitor multiple brands at once? Yes. Track multiple keyword portfolios per account — ideal for MSSPs and enterprises with sub-brands. Keep each brand’s thresholds separate to avoid cross-noise.

Do I still need the blacklist checker? Yes, as a second opinion. Use registration watch for early warning and the blacklist checker to confirm if a domain is already flagged across 12 DNSBLs.

Ready to automate this? Start with the Domain Intelligence API for a free preview, enable Malicious Domain Alerts for your watchlist, and compare cost on Pricing. If you want a live walkthrough, reach us at [email protected].

← Back to blog