Data Feeds

Domain Services | Premium Domains

Data Feeds
Predictive risk scoring and infrastructure profiling
Assess and Contextualize Threats at Scale
Most domain or IP reputation feeds rely on observing dangerous behavior before a domain or IP is added to a blocklist. This reactive approach leaves organizations exposed to attacks from new or previously unseen “sleeper” domains. DomainTools Hotlists and Risk Feeds leverage proprietary technologies to predict the risk level and likely threats associated with domains and IP addresses that may not yet have been observed in malicious activities, while Domain Discovery Feed provides the most rapid updates on newly-registered domains, to keep you ahead of nascent campaigns.

Domain Risk Feed and Hotlist
Domain Hotlist leverages DomainTools Risk Score as the foundation for a predictive block list that is published daily. Each update contains domains that are associated with Passive DNS (pDNS) activity within the last day, a Threat Profile score of 90+, and/or a Proximity score of 70+.
Hosting IP Risk Feed and IP Hotlist
DomainTools IP Risk products identify potentially dangerous infrastructure based on hosted domains. The IP Hotlist is highly filtered based on risk score and traffic, while the Hosting IP Risk Feed contains all IPv4 addresses hosting at least one domain, regardless of traffic or risk.
Domain Discovery Feed
Thousands of malicious domains are registered and used every day, and as a result, many security teams use a domain’s age as a signal of risk, with brand-new domains standing out. The DomainTools Domain Discovery Feed is a daily list of all newly-registered or newly observed domains identified by our best-in-class suite of infrastructure discovery technologies.