write a script querying hosts and optionally double-checking using rdap/whois if you get nxdomain (won't work for all TLDs, for example .es (error message when querying whois) or .pt (no response, request timeout)); depends on how detailed data you need, might be best to just scan hosts and call it a day; but for gtlds at least using rdap will also be efficient