Enhance Detection and Blocking of Dangerous Infrastructure
Domain Hotlist leverages DomainTools® Risk Score as the foundation for a predictive block list that is published daily.
Daily updates
Each update contains domains that are associated with Passive DNS activity within the last day, a Threat Profile score of 90+, and/or a Proximity score of 70+.
- Isolate infrastructure that is both malicious and operational
- Ideal for building blocking and detection rules
Domain Risk Score and Passive DNS Activity Signals
-
Pinpoint Operational Threat Infrastructure
Millions of domains are controlled by threat actors, but the infrastructure actively receiving traffic is the most dangerous. DomainTools uses Farsight DNSDB and other top-tier providers of passive DNS data to identify which domains are operational.
-
Enhance Key SOC and Threat Intel Workflows
Many security workflows depend on the identification of malicious infrastructure. Domain Hotlist is ideal for:
Confidence in the Data
The most trusted online infrastructure data. Anywhere.
Near real-time risk scoring on all newly registered and discovered domains
>97% of currently registered domains
Sophisticated associations across datasets to accelerate action.
About the DomainTools risk score
DomainTools Risk Score predicts how likely a domain is to be malicious, often before it is weaponized. The score comes from two distinct machine learning algorithms:
- Proximity — how closely a domain is connected to other known-bad domains
- Threat Profile — how closely a domain resembles other known-bad domains
