Find newly observed domains for security triage
Build a review queue from new domain lists using transparent keyword rules. Export matched domains for correlation with independent security signals.
All datasets are updated daily by 9:00 AM UTC.
A practical Cybersecurity workflow
- Choose terms relevant to the threats your team investigates.
- Filter the dated new-domain file and retain the matching rules.
- Review candidates alongside your existing threat intelligence.
What the script produces
A reproducible keyword-based review queue for your analysts. Matches are leads for investigation, not malicious-domain verdicts.
Python example: Cybersecurity
Requires Python 3.9 or later. Uses the standard library only, processes local files, and makes no network requests. Save the script beside your downloaded inputs, or provide full paths.
Run the example
python3 cybersecurity.py new.txt.gz --terms login verify walletResults are printed to the terminal. Redirect standard output to a file if you want to save the report. For the SQLite example, the database is saved at the path you specify.
Complete script
import argparse
import csv
import gzip
import sys
def domains(path):
with gzip.open(path, "rt", encoding="utf-8") as source:
for line in source:
domain = line.strip().lower().rstrip(".")
if domain:
yield domain
parser = argparse.ArgumentParser(description="Find keyword matches for security review")
parser.add_argument("file")
parser.add_argument("--terms", nargs="+", required=True)
args = parser.parse_args()
writer = csv.writer(sys.stdout)
writer.writerow(["domain", "matched_terms"])
for domain in domains(args.file):
matches = [term for term in args.terms if term.lower() in domain]
if matches:
writer.writerow([domain, ";".join(matches)])
To automate input downloads, follow the API documentation for tokens, supported endpoints, and historical dates. Keep API tokens out of shared scripts.
How to interpret the results
Keyword matching creates false positives and misses threats without those terms. Newly observed does not mean newly registered or malicious. Correlate results with independent evidence before taking action.
Record the input filename and observation date with your results. Differences in zone coverage and source availability can affect comparisons. Review dataset formats and coverage before expanding the workflow.
Cybersecurity example questions
What data do I need to run this example?
Use New domain lists. Download gzip-compressed domain-name files and pass their local paths to the script. The research comparison requires two snapshots of the same zone.
How should I use the output?
A reproducible keyword-based review queue for your analysts. Matches are leads for investigation, not malicious-domain verdicts. Keyword matching creates false positives and misses threats without those terms. Newly observed does not mean newly registered or malicious. Correlate results with independent evidence before taking action.
Can I schedule this workflow?
Yes. Download the required dated files through the API, then run the script locally. Check file dates before processing and retain the inputs needed to reproduce your results.
Explore more use cases
Put domain data to work
Inspect the datasets, choose access, or discuss requirements for your team.