What Is a Newly Observed Domain and Why Does It Matter for Cybersecurity?

A newly observed domain (NOD) is one that has just appeared in Domain Name System (DNS) traffic for the first time, indicating that it has started being queried, resolved, or otherwise seen in DNS activity. Tracking newly observed domains has become an important part of modern threat intelligence because threat actors often register domains in batches and well in advance — sometimes months ahead — then activate them only when a campaign is ready to launch or when the previous domain they used was taken down. 

We discuss NODs in more detail in this post, including how they differ from newly registered domains, the risks they pose, and how to track them.

What Is a Newly Observed Domain?

A newly observed domain is a domain that is seen in the DNS for the first time within a particular dataset, sensor network, and observation window. The classification is relative to whoever is watching that domain, so a domain that’s new to one group of sensors might already be known to another.

It’s also worth noting that vendors implement the concept differently. Some define observation windows, while others don’t. Akamai’s NOD research, for example, flags a domain as newly observed if it’s queried for the first time in the last 60 days, based on Akamai’s DNS query logs.

Cisco Systems defines domains as newly seen (their version of newly observed domains) if they were queried for the first time within the past 24 hours by any user of Cisco Umbrella or OpenDNS.

Others, such as Fortinet and Palo Alto, don’t use a specific window at all. They classify a domain as newly observed when it’s detected for the first time. 

NODs vs. NRDs: What’s the Difference?

The idea of newly observed domains overlap somewhat with a more well-known concept — newly registered domains (NRDs). And so do the reasons for blocking them. But there are differences.

	NRD	NOD
What it measures	When a domain was registered	When a domain was first seen in the DNS
Data source	RDAP/WHOIS database	DNS traffic (active and passive DNS database)
Relative	No	Yes
Domain usage	Likely not active at the time of registration, may never be used at all	Already active, since it appears in DNS telemetry
Example scenario	A domain registered today is considered an NRD by the WhoisXML API within the first 30 days of its most recent registration.	A domain registered years ago remained dormant until yesterday, when it was first queried or seen resolving to an IP address by a certain DNS sensor network.

What Are the Dangers of NODs?

Some threat patterns are more common in NODs than in established domains. 

• Phishing: A domain with no traffic history may not yet have accumulated enough reputation data to appear on blocklists, giving attackers a cleaner slate to run a phishing site before defenders catch on.
• Malware distribution: Some malware families use domain generation algorithms (DGAs) to generate large batches of DGA subdomains and domains and to rotate botnet command and control (C2) endpoints. When older C2 domains are blocked, infected machines query the next DGA domain for the first time, which then becomes a newly observed domain.
• Typosquatting: Lookalike domains built to mimic a legitimate brand can be registered in advance and then activated shortly before a campaign launches. When threat actors start using the typosquatting domain, that domain becomes newly observed even if the registration happened earlier.
• Scam and spam campaigns: A domain can go live, run a burst of traffic pushing fake giveaways, counterfeit storefronts, donation drives, or unsolicited email, and then disappear before it is detected. These campaigns move fast, but the domains behind them tend to appear in the DNS traffic for the first time right as the campaign launches, which is what NOD tracking is built to catch.  

Keep in mind that not all NODs are associated with cybercriminal activities. There are plenty of legitimate reasons a domain can be flagged as NOD, such as a new business launching its first website, a company creating a new marketing microsite, or an internal tool getting its first DNS entry. 

How to Track and Detect Newly Observed Domains

Tracking NODs at Global Scale

Tracking NODs at a global scale isn’t something most organizations can build themselves. It requires a network of sensors spread across many different networks, capturing DNS traffic in something close to real time, then correlating all of it fast enough to flag a domain the moment it starts resolving.

That’s a significant infrastructure investment, which is why only a handful of major vendors run this kind of collection at scale. Most security vendors and enterprises buy or license the data from whoever already has it.

Passive DNS databases are one option, and they’re quite useful. A passive DNS database logs domain resolutions collected from sensors on contributing networks, then makes that history searchable. 

But there’s a catch. These databases are usually updated on a daily basis or even less frequently, so there’s a lag between the moment a domain becomes active and the moment that activity is logged in the database. For most domain research, that lag doesn’t matter much. But for NOD detection specifically, it does: if a previously unseen malicious domain has just become active, it means that the attack has just started — and those targeted with it don’t have the time to wait until this domain is added to the database.

This is the gap the Internet Abuse Signal Collective (IASC) aims to close. Rather than relying on a static dataset, IASC pools live telemetry from a network of partners, including:

• Registrars
• DNS resolvers
• ISPs
• CERTs
• Cybersecurity vendors

These partners contribute real-time DNS and NetFlow traffic, honeypot data, and known command-and-control (C2) infrastructure signals. Because the data comes in continuously from active sensors across many networks, security vendors aiming to build their own NOD feeds can pinpoint the moment a domain becomes active and observe where related traffic is flowing across the internet. This dual approach reduces the attacker’s head start, giving security vendors and their clients a window to proactively detect and block malicious NODs.

Organizations that want this kind of near-real-time visibility without deploying their own global sensor network can fill out a form with a request to join the IASC request. 

Tracking NODs at the Network Level

The easiest way to detect NODs at the network level is if your firewall or DNS resolver already supports NOD detection. 

But if your firewall doesn’t have NOD support, a DIY approach is possible with these steps:

1. For any domain you want to check, query a passive DNS history service, such as the WhoisXML API’s DNS Chronicle API, which returns historical DNS records for that domain.
2. If the domain has a prior DNS record within a certain timeframe that you’ve specified for your own definition of newly observed domains, it’s not a NOD. It already has DNS traffic history that you can factor into your risk assessment. 
3. If no history within the given timeframe exists, treat it as a potential NOD and flag it for caution. Remember that a domain with no recorded history in your dataset may still have existed elsewhere or been visible to another provider.

Example

If you wanted to check example[.]com, a request to the DNS Chronicle API that looks like this:

curl -sS -X POST 'https://dns-history.whoisxmlapi.com/api/v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "apiKey": "YOUR_API_KEY",
    "searchType": "forward",
    "recordType": "a",
    "domainName": "example.com" 
  }'

Would return thousands of DNS records, including very recent ones. This is definitely not an NOD.

However, if you try requesting DNS history for a different domain newly-registered-example[.]com, it returns no results:

If such a domain shows up in your logs, you can treat it as a potential NOD.

Best Practices for Using NOD Data

NOD classification alone doesn’t mean that you are dealing with a malicious domain. Still, it’s a significant risk signal, especially when combined with other indicators such as registrant details, domain name registrars, and name servers. A layered approach that looks like the following works best:

• Flag the domain when it first shows up as newly observed.
• Monitor its behavior over the following days. Does it start generating an unusual traffic volume? Does it resolve to infrastructure already associated with known threats?
• Correlate with other threat intelligence feeds, such as scores from a reputation checker, SSL/TLS certificate details, and known malicious IP ranges, to check the domain’s authenticity.
• Block only once you have corroborating evidence, not on NOD status by itself. This action would still depend on your organization’s risk tolerance. Some organizations in high-risk environments choose to block on NOD status alone and accept the higher false-positive rate as the cost of tighter security. 

Frequently Asked Questions

What does “newly observed domain” mean?

A newly observed domain is one that appears in DNS traffic for the first time or for the first time within its defined tracking window. The exact window varies by vendor, but the idea stays the same—it doesn’t refer to the domain’s age, but to the first time it entered someone’s field of view.

Are newly observed domains always newly registered? 

No. A newly observed domain may have been registered days, weeks, months, or even years before it is first seen in a given DNS dataset.

What’s the difference between a NOD and a newly active domain?

The two terms are closely related, but with distinct meanings:

• Newly observed domain: Not previously seen in the dataset, network, or defined observation window.
• Newly active domain: It was observed before, became inactive for a specific period, and has recently been seen again. 

Can a subdomain be a NOD?

It depends on the vendor. Many providers track fully qualified domain names (FQDNs), such as mail.subdomain.example[.]com. For WhoisXML API users, this depends on their own definition. Because we supply the raw DNS queries, resolutions, and timestamps, users can apply their own criteria to decide if a domain is newly observed.

Can two security vendors classify the same domain differently?

Yes. Since NOD status depends on a vendor’s specific dataset, sensor network, and observation window, two vendors can reasonably disagree about whether the same domain counts as newly observed at the same point in time. One vendor’s passive DNS sensors might have already seen a domain that’s still brand new to another vendor’s coverage.

How can newly observed domains be used to detect emerging cyber threats or attacks?

NOD data gives defenders a way to flag possible cybercriminal activity before a malicious domain accumulates the reputation history that most blocklists rely on. Correlating that with reputation scores, SSL/TLS certificate data, and known malicious infrastructure, NOD tracking helps catch phishing websites, command and control servers, and other threats closer to the moment they go live, rather than after they’ve already caused damage.