We have had a “newly registered domain” feed for a few years. This feed pulls data from ICANN's centralized zone data service (https://czds.icann.org) and TLS certificate transparency logs.
This article has been indexed from SANS Internet Storm Center, InfoCON: green