IP Hotlist

The IP Hotlist feed identifies high-risk IP addresses that host hostile domains actively communicating within a 24-hour time window. This focused feed provides risk scores and enrichment data for IP addresses where more than 50% of hosted domains are high-risk and actively communicating.

Overview

This feed captures IP addresses that meet strict criteria for both risk level and recent activity, making it ideal for immediate blocking and threat response. The feed provides the same enrichment data as the IP Risk feed, but filtered to show only the most dangerous and currently active infrastructure.

Use this feed when you need to:

Build high-confidence IP block lists
Identify currently active hostile infrastructure for immediate action
Enhance security operations center (SOC) and threat intel workflows with IP-based enrichment
Create custom network or endpoint block rules
Triage IP-based alerts
Monitor threat actor hosting infrastructure
Detect and respond to active C2 servers

Inclusion criteria: More than 50% of domains on the IP address have a proximity score of 70+ OR Threat Profile score of 90+; pDNS activity on malicious domains within 24 hours.

Daily download format: Gzip-compressed tab-separated (TSV) text file

Size: 40-50,000 IP addresses, ~1MB compressed

Quick Start

Get started with the IP Hotlist feed in under 60 seconds using the Real-time Feed API:

# Start polling for high-risk, actively communicating IPs
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySession'

This returns the last hour of data. Call again with the same sessionID to get only new data since your last request. See Real-time Feed API for complete details and Authentication for auth options.

Requirements

You need the following to access Threat Feeds:

An Enterprise Account with DomainTools, accessible at https://account.domaintools.com/my-account/
Authentication credentials (API key for header authentication, or API username and key for HMAC or open key authentication)
A way to interact with a REST API delivered through AWS

Obtain your API credentials from your group’s API administrator. API administrators can manage their API keys at https://research.domaintools.com, selecting the drop-down account menu and choosing API admin.

For assistance, contact enterprisesupport@domaintools.com.

Authentication

You can authenticate to the IP Hotlist API using three different methods. Choose the method that best fits your security requirements and technical environment.

API key (header) authentication

Authenticate your requests by including the API key in the header of each HTTP request. The API key serves as a unique identifier and authenticates your requests.

Required header:

X-Api-Key: $DOMAINTOOLS_API_KEY

Examples:

# Feed API request
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySession'

# Download API request
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/iphotlist/'

HMAC authentication

HMAC authentication is a secure alternative to API key-based methods. It requires signing each request with an HMAC digest derived from your API key, providing integrity and authenticity without exposing credentials directly in the request.

This method is recommended for systems where authentication credentials shouldn’t be stored in plain text or included directly in request URLs.

DomainTools supports MD5, SHA1, and SHA256 for the hashing algorithm. Use SHA256 — it’s the recommended choice and is more resistant to collision attacks than MD5 or SHA1.

Required query parameters:

api_username: Your DomainTools API username
signature: HMAC-SHA256 signature of api_username + timestamp + uri_path
timestamp: Current UTC timestamp in ISO 8601 format (for example, 2025-06-01T15:30:00Z)

Constructing the HMAC signature:

signature = HMAC-SHA256(api_key, api_username + timestamp + uri_path)

Example Python signing function:

import hmac
import hashlib

def sign(api_username, api_key, timestamp, uri):
    params = f"{api_username}{timestamp}{uri}"
    return hmac.new(api_key.encode("utf-8"), params.encode("utf-8"), hashlib.sha256).hexdigest()

Examples:

# Feed API request with HMAC
curl 'https://api.domaintools.com/v1/feed/iphotlist/?api_username=YOUR_USERNAME&signature=HMAC_SIGNATURE&timestamp=2025-01-06T15:30:00Z&sessionID=mySession'

# Download API request with HMAC
curl 'https://api.domaintools.com/v1/download/iphotlist/?api_username=YOUR_USERNAME&signature=HMAC_SIGNATURE&timestamp=2025-01-06T15:30:00Z'

Open key authentication

This is the easiest authentication scheme to implement, but also the least secure. Each request contains the full API key and API username as query parameters. We recommend using API key header authentication or HMAC authentication instead.

If you’re unsure about your authentication options, contact enterprisesupport@domaintools.com.

Required query parameters:

api_username: Your API username
api_key: Your API key

Examples:

# Feed API request
curl 'https://api.domaintools.com/v1/feed/iphotlist/?api_username=YOUR_USERNAME&api_key=YOUR_API_KEY&sessionID=mySession'

# Download API request
curl 'https://api.domaintools.com/v1/download/iphotlist/?api_username=YOUR_USERNAME&api_key=YOUR_API_KEY'

Real-time Feed API

The Real-time Feed API provides streaming access to IP Hotlist data as risk assessments are updated on a rolling 24-hour basis. This enables real-time monitoring of high-risk, actively communicating hosting infrastructure.

Base URL

https://api.domaintools.com/v1/feed/iphotlist/

Feed API rate limits

Real-time feeds have the following rate limits:

2 queries per minute
120 queries per hour

If you exceed these limits, the API returns an error.

Feed API response formats

The API supports two response formats:

NDJSON (Newline-Delimited JSON)

Default format when no Accept header is specified
Also known as JSON Lines (JSONL)
One JSON object per line
Efficient for streaming and processing large datasets
Set Accept: application/x-ndjson to explicitly request this format

CSV (Comma-Separated Values)

Set Accept: text/csv to request CSV format
Add &headers=1 to the query parameters to include column headers as the first line
Not available for all feeds; check the specific feed documentation for CSV support

Feed API session management

Session management allows you to maintain your position in the feed data stream, ensuring you don’t miss or duplicate events when polling the API.

How sessions work:

Start a new session: Provide a unique sessionID parameter of your choosing. By default, the API returns the past hour of results.
Resume a session: Use the same sessionID in subsequent requests. The API returns all data since your last request.
Handle large result sets: If a single request exceeds 10M results, the API returns an HTTP 206 response code. Repeat the same request with the same sessionID to receive the next batch of data until you receive an HTTP 200 response code.
One request at a time: Do not send simultaneous requests with the same sessionID for the same feed. Wait for each request to complete before sending the next one. Concurrent requests with the same sessionID can produce errors or incomplete results.
Delete a session: Use an HTTP DELETE request with your sessionID to clear the saved offset and start fresh.

Session ID requirements:

1 to 64 characters in length
Alphanumeric characters and hyphens only ([a-zA-Z0-9-]+)
Case-sensitive

Feed API quick start

Start a new session:

curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySOC'

A new sessionID returns the last hour of data by default.

Continue polling for new updates:

# Call again with the same sessionID to get only new data since last call
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySOC'

Feed API parameters

Session management

`sessionID`

Type: String

Valid values: 1-64 alphanumeric characters and hyphens ([a-zA-Z0-9-]+)

Description: A unique identifier for the session, used for resuming data retrieval from the last point. Use a new sessionID to begin a new session, fetching the most recent hour by default. Reuse the same sessionID to return all feed data since your last request. If omitted, time window parameters (such as after/before) are required.

Example: sessionID=mySOC

Required: Yes, to continue where you left off (or use after/before instead)

`after`

Type: Integer or string

Valid values:

Integer: -1 to -432,000 (relative seconds before current time)
String: ISO 8601 datetime in UTC format (YYYY-MM-DDTHH:MM:SSZ)

Description: The start of the query window (inclusive). When using an integer, the value is in seconds relative to the current time. When using a string, provide an absolute timestamp. The query window covers the most recent 5 days. A value older than 5 days is capped to the start of that window, and the response begins 5 days back.

Example: after=-60 or after=2024-10-16T10:20:00Z

Required: Yes, if before or sessionID not provided

`before`

Type: Integer or string

Valid values:

Integer: -1 to -432,000 (relative seconds before current time)
String: ISO 8601 datetime in UTC format (YYYY-MM-DDTHH:MM:SSZ)

Description: The end of the query window (inclusive). When using an integer, the value is in seconds relative to the current time. When using a string, provide an absolute timestamp. The query window covers the most recent 5 days. A value older than 5 days places the window entirely outside it, and the response contains no records.

Example: before=-120 or before=2024-10-16T10:20:00Z

Required: Yes, if after or sessionID not provided

`fromBeginning`

Type: Boolean

Valid values: true, false, 1, 0

`top`

Type: Integer

Valid values: Positive integer, 1-1,000,000,000

Description: Limits the number of results in the response payload. Primarily intended for testing.

Example: top=10

Required: No

`headers`

Type: Boolean

Valid values: true, false, 1, 0

Description: Adds a header row as the first line of the response when text/csv is requested. Set headers=1 to enable; false is the default. Enabling it on a request that doesn’t ask for text/csv returns HTTP 422, as does a value that isn’t a boolean.

Example: headers=1

Required: No

Feed API response structure

The Feed API returns NDJSON (newline-delimited JSON) with one IP entry per line. Each entry includes a timestamp field indicating when the risk assessment was updated, plus all IP risk and enrichment fields.

Response fields:

timestamp (string): ISO 8601 UTC timestamp when the risk assessment was updated

Note: For real-time feeds, the total_domains field reflects domains seen over the last 30 days (not 7 days as in the daily feed).

Note: Percentage fields are a share of total_domains, truncated to an integer. A computed 37.5 percent is reported as 37.

Example response:

{"timestamp":"2025-01-06T15:30:42Z","ip":"192.0.2.1","asn":12345,"organization":"Example Hosting LLC","city":"Amsterdam","country":"NL","latitude":52.3676,"longitude":4.9041,"pdns_resolutions":47,"bad_pdns_resolutions":42,"total_domains":183,"zerolist_domains":0,"zerolist_ip":false,"third_party_threats":38,"all_threats_combined_count":122,"all_threats_combined_percent":66,"all_threats_percent":66,"combined_phishing_percent":21,"combined_malware_percent":26,"combined_spam_percent":18,"malicious_phishing":28,"malicious_malware":33,"malicious_spam":22,"percent_phishing":21,"percent_malware":26,"percent_spam":18,"compromised_phishing":6,"compromised_malware":8,"compromised_spam":4,"predicted_phishing":6,"predicted_malware":7,"predicted_spam":8}
{"timestamp":"2025-01-06T15:30:45Z","ip":"192.0.2.2","asn":67890,"organization":"Bulletproof Networks Inc","city":"Moscow","country":"RU","latitude":55.7558,"longitude":37.6173,"pdns_resolutions":31,"bad_pdns_resolutions":29,"total_domains":94,"zerolist_domains":0,"zerolist_ip":false,"third_party_threats":25,"all_threats_combined_count":87,"all_threats_combined_percent":92,"all_threats_percent":92,"combined_phishing_percent":30,"combined_malware_percent":38,"combined_spam_percent":23,"malicious_phishing":19,"malicious_malware":24,"malicious_spam":15,"percent_phishing":30,"percent_malware":38,"percent_spam":23,"compromised_phishing":4,"compromised_malware":5,"compromised_spam":3,"predicted_phishing":6,"predicted_malware":7,"predicted_spam":4}

IP and infrastructure fields

Field	Description
`ip`	IP address that has www/apex domains pointing to it
`asn`	The IP’s ASN (autonomous system number, routing provider)
`organization`	Organization associated with IP range based on geo data
`city`	City based on IP geo data
`country`	Country based on IP geo data
`latitude`	Geographic coordinates
`longitude`	Geographic coordinates

Domain activity metrics

Field	Description
`pdns_resolutions`	Number of domains seen on the IP in the last 24 hours
`bad_pdns_resolutions`	Number of confirmed bad domains seen on the IP in the last 24 hours
`total_domains`	Total number of domains seen on this IP in the last 7 days
`zerolist_domains`	Number of zero-listed domains seen on this IP
`zerolist_ip`	Indicates if this IP is zero-listed (e.g., CDN)

Threat intelligence metrics

Field	Description
`third_party_threats`	Number of domains on IP confirmed with any threat on a third-party intel feed
`all_threats_combined_count`	Number of confirmed or predicted domains on third-party intel feed or threat profile
`all_threats_combined_percent`	Percentage of `total_domains` that are confirmed or predicted malicious
`all_threats_percent`	Percentage of `total_domains` including all threat types

Combined threat predictions

Field	Description
`combined_phishing_percent`	Percentage of `total_domains` confirmed or predicted as phishing
`combined_malware_percent`	Percentage of `total_domains` confirmed or predicted as malware
`combined_spam_percent`	Percentage of `total_domains` confirmed or predicted as spam

Confirmed malicious threats

Field	Description
`malicious_phishing`	Number of malicious phishing domains on third-party intel feeds
`malicious_malware`	Number of malicious malware domains on third-party intel feeds
`malicious_spam`	Number of malicious spam domains on third-party intel feeds
`percent_phishing`	Percentage of `total_domains` that are confirmed phishing
`percent_malware`	Percentage of `total_domains` that are confirmed malware
`percent_spam`	Percentage of `total_domains` that are confirmed spam

Compromised threats

Field	Description
`compromised_phishing`	Number of compromised phishing domains on third-party intel feeds
`compromised_malware`	Number of compromised malware domains on third-party intel feeds
`compromised_spam`	Number of compromised spam domains on third-party intel feeds

Predicted threats

Field	Description
`predicted_phishing`	Number of domains (with no confirmed threat) predicted as phishing
`predicted_malware`	Number of domains (with no confirmed threat) predicted as malware
`predicted_spam`	Number of domains (with no confirmed threat) predicted as spam

Feed API response codes

Code	Status	Description
`200`	OK	The request was successful and all data has been delivered
`206`	Partial content	The request was successful, but only a portion of the data was returned. The request exceeded 10M results or the 1-hour evaluation window. Repeat the same request with the same `sessionID` to receive the next batch of data until you receive an HTTP `200` response
`400`	Bad request	The request is malformed
`403`	Forbidden	Missing or invalid API credentials
`404`	Not found	The requested resource (such as a `sessionID`) doesn’t exist
`406`	Not acceptable	Either the specified `Accept` header value isn’t supported (only `application/x-ndjson` and `text/csv` are accepted), or `fromBeginning` was used with a `sessionID` that already exists
`422`	Unprocessable entity	The request is syntactically valid but violates semantic or domain-specific rules (for example, invalid query parameter values)

Feed API examples

Basic session polling:

# Start a new session
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySOC'

# Resume the session (returns data since last request)
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySOC'

Time window filtering:

# Get data from a specific time range
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?after=2025-01-06T10:00:00Z&before=2025-01-06T11:00:00Z'

CSV format:

# Request CSV format with headers
curl -H 'Accept: text/csv' -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?headers=1&sessionID=mySOC'

# Request CSV format without headers
curl -H 'Accept: text/csv' -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySOC'

Limiting the response size:

# Limit the response to 10 records
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?top=10&sessionID=mySOC'

Filtering by threat metrics:

# IPs with at least 50% of domains confirmed or predicted malicious, excluding superhosters
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?all_threats_combined_percent_min=50&total_domains_max=1000&sessionID=mySOC'

Handling large result sets:

# If you receive HTTP 206, repeat the request to get the next batch
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySOC'
# Repeat until you receive HTTP 200

Delete a session:

# Clear the saved offset and start fresh
curl -X DELETE -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/feed/iphotlist/?sessionID=mySOC'

Real-time Download API

The Real-time Download API provides access to historical IP Hotlist data through temporary Amazon Web Services (AWS) S3 file links. Files are organized by hour and available for 90 days.

Base URL

https://api.domaintools.com/v1/download/iphotlist/

Download API parameters

Type: Integer

Valid values: Positive integer

Description: Limits the number of files returned in the response, starting from the most recent. Use to control payload size or test specific cases.

Example: limit=10

Required: No

Type: Integer

Valid values: Non-negative integer (0, 1, 2, …)

Description: Selects which page of results to return. Pages begin at 0 with the latest results. Use with limit and prefix to control results. The server returns an HTTP 404 (No data to download.) message when the page request exceeds the last page of results.

Example: page=3

Required: No

Type: String

Valid values: Date/time prefix matching the feed’s filename format

Description: Filters results by date using the file prefix. Use with page and limit to control results. Filename prefixes vary by feed. For example, files for this feed begin with the date in YYYY-MM-DD format.

Example: prefix=2025-06-24

Required: No

Download API response structure

The API returns a JSON response containing an array of downloadable files. Each file entry includes:

download_name (string): The feed identifier

files (array): List of downloadable file entries

Each file object contains:

name (string): Path and filename of the downloadable file
last_modified (string): Timestamp of last modification in ISO 8601 UTC format
etag (string): ETag (hash) used to verify file identity and versioning
size (integer): File size in bytes
url (string): Temporary signed URL to download the file from AWS

Download API response codes

Code	Status	Description
`200`	OK	The request was successful
`400`	Bad request	The request is malformed
`401`	Unauthorized	Missing or invalid API credentials
`403`	Forbidden	Missing or invalid API credentials
`404`	Not found	No data to download
`422`	Unprocessable entity	The request is syntactically valid but violates semantic or domain-specific rules (for example, invalid query parameter values)

Download API file naming

Files follow this naming pattern:

iphotlist/YYYY-MM-DD/iphotlist-YYYYMMDD.HH00-HH00.json.gz
iphotlist/YYYY-MM-DD/iphotlist-YYYYMMDD.HH00-HH00.json.gz.sha256

The system produces two files each hour:

A gzipped JSON data file
A SHA-256 checksum file for verification

Download API file contents

When uncompressed, the *.json.gz file contains JSON data in the same format as the Feed API response (NDJSON with timestamp and all IP risk fields).

Download API examples

List available files:

curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/iphotlist/?limit=10'

Download and verify a file:

# Get file list
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/iphotlist/?limit=2' > files.json

# Extract URLs (select by file extension to avoid index fragility)
DATA_URL=$(jq -r '.response.files[] | select(.name | endswith(".json.gz")) | .url' files.json)
CHECKSUM_URL=$(jq -r '.response.files[] | select(.name | endswith(".sha256")) | .url' files.json)

# Download files
curl -o iphotlist.json.gz "$DATA_URL"
curl -o iphotlist.json.gz.sha256 "$CHECKSUM_URL"

# Verify checksum
sha256sum -c iphotlist.json.gz.sha256

# Decompress and view
gunzip iphotlist.json.gz
head iphotlist.json

Batch download multiple files:

# Download all files from the last 24 hours
for url in $(curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/iphotlist/?limit=24' | \
  jq -r '.response.files[].url' | grep '\.json\.gz$'); do
  curl -O "$url"
done

RPZ access

Overview

Response Policy Zone (RPZ) provides DNS-level blocking by integrating Threat Feeds directly into your DNS resolver. This allows you to automatically block or redirect DNS queries for domains in the feed, providing real-time protection before connections are established.

How RPZ works:

When a user attempts to access a domain in the RPZ feed, your DNS resolver responds with an NXDOMAIN (“no such domain”) status code, effectively making the domain unavailable. This blocks malicious domains at the DNS layer, preventing endpoint communication before any connection is established.

Benefits:

Real-time protection: Blocks threats at the DNS resolver level
Automatic updates: Receives updates via DNS zone transfers (AXFR/IXFR)
No client configuration: Works transparently for all clients using your DNS resolver
Efficient: Minimal performance impact on DNS resolution
Standard protocol: Uses DNS Response Policy Zones specification

Zone naming format:

RPZ zones are named using the pattern: [interval].[feed].rpz.domaintools.com

Available time intervals: 5m, 10m, 30m, 1h, 3h (and 12h/24h for some feeds — availability varies by feed)

Larger time intervals are supersets that include smaller intervals. Smaller intervals have smaller zone sizes and may be available faster.

Available zones

IP Hotlist provides multiple RPZ zones with different time windows, allowing you to choose the appropriate balance between coverage and freshness for your security requirements.

5m.iphotlist.rpz.domaintools.com - IPs active in last 5 minutes
10m.iphotlist.rpz.domaintools.com - IPs active in last 10 minutes
30m.iphotlist.rpz.domaintools.com - IPs active in last 30 minutes
1h.iphotlist.rpz.domaintools.com - IPs active in last 1 hour
3h.iphotlist.rpz.domaintools.com - IPs active in last 3 hours

Each zone uses .rpz-ip trigger entries to block connections to the listed IP addresses.

Configuration

Configuration requirements:

To access RPZ feeds, you need to:

Provide IP addresses: Contact enterprisesupport@domaintools.com with:
- IP address(es) from which you connect to the RPZ provider DNS server
- IP address(es) to receive DNS NOTIFY messages (typically the same)
Configure firewall: Add rules to allow DomainTools hosts to send UDP packets to port 53:
- IPv4: 104.244.13.88 Port: 53
- IPv4: 104.244.14.88 Port: 53
Set up TSIG authentication: DomainTools uses TSIG (Secret Key Transaction Authentication) for authorization:
- TSIG key algorithm: hmac-sha512
- TSIG key and key name: Provided by DomainTools Enterprise Support

Delivery method:

RPZ feeds are delivered via:

Incremental Zone Transfers (IXFR)
Full zone transfers (AXFR)
DNS NOTIFY messages to trigger zone updates

For detailed configuration instructions, including DNS resolver setup, advanced features (allowlists, walled gardens, logging), and troubleshooting, see the Response Policy Zone documentation.

Testing

Testing your RPZ configuration:

When your DNS resolver blocks a domain using RPZ, the response includes an SOA (Start of Authority) record that identifies which RPZ feed was used.

Test domain:

Each RPZ feed includes a test domain entry: test.rpz.domaintools.test

Use this to verify the RPZ feed is loaded and working. A successful test returns:

NXDOMAIN status code
SOA record in the ADDITIONAL section showing the specific feed name

Example SOA record:

;; ADDITIONAL SECTION:
3h.iphotlist.rpz.domaintools.com. 86400 IN SOA rpz-ns1.domaintools.com. noc.domaintools.com. 946684799 600 300 86400 86400

The SOA SERIAL number (Unix epoch timestamp) indicates when the feed was last regenerated.

Troubleshooting:

If the SOA record appears in the AUTHORITY section instead of ADDITIONAL, or doesn’t show the specific feed name, the response didn’t come from RPZ. Check your DNS resolver’s RPZ-related logs for additional debugging information.

RPZ examples

Configure BIND to use IP Hotlist 1-hour zone:

response-policy {
    zone "1h.iphotlist.rpz.domaintools.com";
};

Transfer the full zone:

dig AXFR 1h.iphotlist.rpz.domaintools.com

Check for zone updates (without transferring the full zone):

dig SOA 1h.iphotlist.rpz.domaintools.com

The SOA SERIAL number is a Unix epoch timestamp indicating when the zone was last updated. Compare it to the previous serial to determine if new data is available.

Check if a specific IP is in the zone:

dig @localhost 32.1.0.192.rpz-ip.1h.iphotlist.rpz.domaintools.com

The IP address is written in reverse order (192.0.1.32 becomes 32.1.0.192) and prefixed with 32 to indicate a /32 single-host netmask. This is the standard RPZ IP trigger format defined in the RPZ specification. An NXDOMAIN response indicates the IP is in the zone and would be blocked by your resolver.

Daily Download API

The Daily Download API provides access to IP Hotlist data through temporary AWS S3 file links. The feed is updated daily with high-risk, actively communicating IPs.

Base URL

https://api.domaintools.com/v1/download/daily_ip_hotlist/

Daily Download parameters

The Daily Download API supports standard download parameters. Authentication parameters (api_username, api_key, signature, timestamp) are covered in Authentication.

Type: Integer

Valid values: Positive integer

Description: Limits the number of files returned in the response, starting from the most recent. Use to control payload size or test specific cases.

Example: limit=10

Required: No

Type: Integer

Valid values: Non-negative integer (0, 1, 2, …)

Example: page=3

Required: No

Type: String

Valid values: Date/time prefix matching the feed’s filename format

Example: prefix=2025-06-24

Required: No

Daily Download response structure

The API returns a JSON response with signed URLs for downloadable files:

download_name (string): The feed identifier (daily_ip_hotlist)

files (array): List of downloadable file entries

Each file object contains:

name (string): path
last_modified (string): Last modified date in ISO 8601 format
etag (string): Entity tag (hash of the file)
size (integer): Size in bytes
url (string): Signed AWS download URL (valid for 12 hours)

Daily Download response codes

200: OK - The request was successful

400: Bad request

401: Unauthorized

403: Forbidden

404: No data to download

Daily Download file naming

The feed provides a single file. The name field returned by the API is:

daily_ip_hotlist/ip_hotlist.gz

This file contains high-risk IP addresses with recent malicious activity, updated daily.

File contents

The TSV file contains the following fields (tab-separated, one IP per line):

IP and infrastructure fields

Field	Description
`ip`	IP address that has www/apex domains pointing to it
`asn`	The IP’s ASN (autonomous system number, routing provider)
`organization`	Organization associated with IP range based on geo data
`city`	City based on IP geo data
`country`	Country based on IP geo data
`latitude`	Geographic coordinates
`longitude`	Geographic coordinates

Domain activity metrics

Field	Description
`pdns_resolutions`	Number of domains seen on the IP in the last 24 hours
`bad_pdns_resolutions`	Number of confirmed bad domains seen on the IP in the last 24 hours
`total_domains`	Total number of domains seen on this IP in the last 7 days
`zerolist_domains`	Number of zero-listed domains seen on this IP
`zerolist_ip`	Indicates if this IP is zero-listed (e.g., CDN)

Threat intelligence metrics

Field	Description
`third_party_threats`	Number of domains on IP confirmed with any threat on a third-party intel feed
`all_threats_combined_count`	Number of confirmed or predicted domains on third-party intel feed or threat profile
`all_threats_combined_percent`	Percentage of `total_domains` that are confirmed or predicted malicious
`all_threats_percent`	Percentage of `total_domains` including all threat types

Combined threat predictions

Field	Description
`combined_phishing_percent`	Percentage of `total_domains` confirmed or predicted as phishing
`combined_malware_percent`	Percentage of `total_domains` confirmed or predicted as malware
`combined_spam_percent`	Percentage of `total_domains` confirmed or predicted as spam

Confirmed malicious threats

Field	Description
`malicious_phishing`	Number of malicious phishing domains on third-party intel feeds
`malicious_malware`	Number of malicious malware domains on third-party intel feeds
`malicious_spam`	Number of malicious spam domains on third-party intel feeds
`percent_phishing`	Percentage of `total_domains` that are confirmed phishing
`percent_malware`	Percentage of `total_domains` that are confirmed malware
`percent_spam`	Percentage of `total_domains` that are confirmed spam

Compromised threats

Field	Description
`compromised_phishing`	Number of compromised phishing domains on third-party intel feeds
`compromised_malware`	Number of compromised malware domains on third-party intel feeds
`compromised_spam`	Number of compromised spam domains on third-party intel feeds

Predicted threats

Field	Description
`predicted_phishing`	Number of domains (with no confirmed threat) predicted as phishing
`predicted_malware`	Number of domains (with no confirmed threat) predicted as malware
`predicted_spam`	Number of domains (with no confirmed threat) predicted as spam

Daily Download examples

List available files:

curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/daily_ip_hotlist/'

Download the file:

# Get the file list
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/daily_ip_hotlist/' > files.json

# Download the file
curl -o ip_hotlist.gz "$(jq -r '.response.files[0].url' files.json)"

# Decompress and view
gunzip ip_hotlist.gz
head ip_hotlist

Parse TSV data:

# View first 10 IPs: ip, latitude, longitude, pdns_resolutions, bad_pdns_resolutions (cols 1,6,7,8,9)
gunzip -c ip_hotlist.gz | head -10 | cut -f1,6,7,8,9

Filter for specific threat types:

# Find IPs with high longitude value (field 7 = longitude); adjust field number per schema above
gunzip -c ip_hotlist.gz | awk -F'\t' '$7 > 50 {print $1, $7}' | head -20

IP Hotlist

Overview

Quick Start

Requirements

Authentication

API key (header) authentication

HMAC authentication

Open key authentication

Real-time Feed API

Base URL

Feed API rate limits

Feed API response formats

Feed API session management

Feed API quick start

Feed API parameters

Session management

sessionID

after

before

fromBeginning

IP Hotlist filter parameters

pdns_resolutions_min

bad_pdns_resolutions_min

total_domains_max

third_party_threats_min

all_threats_combined_percent_min

combined_phishing_percent_min

combined_malware_percent_min

combined_spam_percent_min

asn

organization

country_code

all_threats_percent_min

percent_phishing_min

percent_malware_min

percent_spam_min

Result formatting

top

headers

Feed API response structure

IP and infrastructure fields

Domain activity metrics

Threat intelligence metrics

Combined threat predictions

Confirmed malicious threats

Compromised threats

Predicted threats

Feed API response codes

Feed API examples

Real-time Download API

Base URL

Download API parameters

Download API response structure

Download API response codes

Download API file naming

Download API file contents

Download API examples

RPZ access

Overview

Available zones

Configuration

Testing

RPZ examples

Daily Download API

Base URL

Daily Download parameters

Daily Download response structure

Daily Download response codes

Daily Download file naming

File contents

IP and infrastructure fields

Domain activity metrics

Threat intelligence metrics

Combined threat predictions

Confirmed malicious threats

Compromised threats

Predicted threats

Daily Download examples

Related resources

`sessionID`

`after`

`before`

`fromBeginning`

`pdns_resolutions_min`

`bad_pdns_resolutions_min`

`total_domains_max`

`third_party_threats_min`

`all_threats_combined_percent_min`

`combined_phishing_percent_min`

`combined_malware_percent_min`

`combined_spam_percent_min`

`asn`

`organization`

`country_code`

`all_threats_percent_min`

`percent_phishing_min`

`percent_malware_min`

`percent_spam_min`

`top`

`headers`