Catch Coordinated Bulk Domain Registrations

Bulk Registration Risk Data Feed Structure and Delivery

• Grouped by cluster

  Domains are grouped using creation time, registrar, and nameserver data, the same registration signals shown to predict abuse across new gTLDs.

• Enriched with WHOIS and DNS data

  The Enriched data feed adds registration data (registrar, registrant, creation and expiration dates) and DNS data (nameserver and IP resolution) to every cluster.

• Detection metadata

  Clusters include first-seen date, cluster ID, and group size, giving you the context to trace how a batch formed and gauge its scale.

• Daily Delivery

  Bulk Registration Risk Data Feed is updated daily. Weekly and monthly updates are also provided.

Frequently Asked Questions

Why are bulk-registered domains dangerous?

Bulk registration lets one registrant buy hundreds or even thousands of domains, whether through a single transaction or an automated process that executes many separate transactions in quick succession. That volume creates risk for security teams and brands alike because:

• They allow threat actors to rotate weapons quickly. A large domain pool gives attackers the infrastructure needed to run botnets, spam, phishing, and malware campaigns. When security teams or solutions block one domain, the attacker just switches to the next one in the pool.
• They slow down security response. A cluster of related domains may be harder to investigate than one suspicious domain. Analysts have to trace DNS records, hosting overlaps, SSL certificates, and redirect chains across every domain in the group. That manual work slows response time and adds to the pile of alerts a team has to sort through.
• They enable large-scale attacks. An attacker can register hundreds or thousands of domains in minutes, then launch a global attack across many networks simultaneously before any detection system catches the pattern.
• They erode brand trust. Bulk-registered attacks often include typosquats, lookalike characters, extra words tacked onto a brand name, fake support pages, bogus coupon sites, or spoofed login pages. Customers can't always tell the difference, and the trust damage lands on the real company even though it had nothing to do with the attack.

Are bulk-registered domains always malicious?

No. Plenty of organizations register domains in bulk for good reasons.

• Brand protection teams buy misspellings and lookalikes.
• Companies expanding into new markets register domains under regional TLDs.
• Marketing teams launch campaigns across multiple sub-brands or product lines.

Bulk registration itself isn't the problem. It's a tool that's used for both legitimate and malicious purposes.

What data points does the Bulk Registration Risk Data Feed contain?

The feed comes in three versions — Basic, Enriched, and Community, which have different data points. For more specific information, check out the documentation.

What's the difference between Basic, Enriched, and Community databases?

• Basic gives you the list of bulk-registered domains.
• Enriched adds WHOIS ownership and infrastructure data, so you can see who registered the domains, through which registrar, and where they're hosted.
• Community is a free trial version, limited to a daily feed built around a set of common typosquatting buzzwords like "bank," "settlement," or "support."

What counts as a bulk-registered domain cluster?

A group of domains is added to the Bulk Registration Risk Feed when at least three domains that appeared on the same day are found to share similar second-level domain naming patterns. These signals help identify likely bulk-registration activity rather than isolated look-alike domains.