Blog
Increase Threat Visibility with DomainTools Real-Time IP Risk Feeds
Real-Time Threat Feeds
Risk Feeds
Predictive feeds that deliver a risk-based view of newly registered or updated domains and infrastructure
Discovery Feeds
Comprehensive feeds that surface newly registered, active, and observed domains and hostnames, providing the foundational visibility to combat emerging threats
WHAT'S INCLUDED
Risk Feeds
Domain RiskAll high-risk domains with scores for phishing, malware, spam, and proximity
Domain HotlistHighest-risk domains that have become active in passive DNS within the previous 24 hours
IP RiskAll IP addresses hosting at least one domain, with predictive risk scores based on the domains they host. Apply your own criteria to evaluate or characterize IP infrastructure.
IP Hotlist Highly curated list of the riskiest IP addresses on the Internet — those with traffic to malicious domains. A focused, easy-to-act-on subset for blocking and detection, delivered in real-time.
Discovery Feeds
Newly Observed DomainsDomains never before observed in passive DNS
Newly Active DomainsDomains not observed in passive DNS in the previous 10 days
Domain DiscoveryNewly discovered domains, including those not yet active in passive DNS
Newly Observed HostnamesFully qualified domain names (FQDNs) never before observed in passive DNS
How Feeds Work:
How Feeds Work:
Step one
Feeds are delivered in real-time via Real-time Feed API, Download API, RPZ, or MCP Server
Step Two
High-priority domains and IP addresses are surfaced
Step three
Triaging occurs via automated processes and playbooks
Step four
Risky infrastructure is mitigated in under 60 seconds
INTEGRATIONS
Get more from what you have with DomainTools.
Through seamless integrations across leading SIEMs, SOARs, TIPs, LLMs, Datalakes, and other security platforms, DomainTools places rich real-time domain and IP intelligence directly within the tools analysts already use. These integrations can be incorporated into your environment in as quickly as one day, enabling security teams to unlock immediate value.
%202.png)
.svg)
“Through close collaboration this year, we were among the first to adopt DomainTools’ Real Time Feeds and API, reducing the time from threat discovery to active prevention to under one minute. This level of speed and accuracy effectively closes the window for domain-based attacks. DomainTools has set a new standard for real-time, high-fidelity intelligence - critical to any modern, proactive defense strategy.”
Dave Ahn
Chief Architect and VP, Centripetal
