Threat Intel Feed

Domain Risk Feed and Hotlist

Daily risk-scored domain database

Request a Demo

Enhance Detection and Blocking of Dangerous Infrastructure

Domain Hotlist leverages DomainTools® Risk Score as the foundation for a predictive block list that is published daily.

Daily updates

Each update contains domains that are associated with Passive DNS activity within the last day, a Threat Profile score of 90+, and/or a Proximity score of 70+.

  • Isolate infrastructure that is both malicious and operational
  • Ideal for building blocking and detection rules

Domain Risk Score and Passive DNS Activity Signals

Confidence in the Data

The most trusted online infrastructure data. Anywhere.


Near real-time risk scoring on all newly registered and discovered domains


>97% of currently registered domains


Sophisticated associations across datasets to accelerate action.

About the DomainTools risk score

DomainTools Risk Score predicts how likely a domain is to be malicious, often before it is weaponized. The score comes from two distinct machine learning algorithms:

  • Proximity — how closely a domain is connected to other known-bad domains
  • Threat Profile how closely a domain resembles other known-bad domains

Related Domain Risk Feed and Hotlist Resources