Threat Feeds: use cases

Patterns for integrating Threat Feeds into common security workflows, organized by objective.

Proactive defense

Use DomainTools Threat Feeds to proactively reduce exposure to attacker-controlled infrastructure before it is used against your environment. These feeds enable both preventive controls and risk-informed allow/deny decisions.

Ingestion and integration options

• Ingest via API or data pipeline into a Security Information and Event Management (SIEM), Extended Detection and Response (XDR), or data platform for downstream control logic and automation.
• Schedule feed downloads or run streaming pipelines for continuous updates.
• Enforce at the DNS layer with Response Policy Zone (RPZ) for automated blocking at resolution time.
• Apply selective enforcement in firewalls or endpoint controls for high-confidence indicators.

Preventive controls

• Apply targeted blocking using curated subsets of Domain Hotlist or IP Hotlist based on confidence thresholds.
• Use RPZ zones (Domain Hotlist, Newly Observed Domains, Newly Active Domains) for DNS-based prevention where appropriate.
• Use IP Risk to identify widely used hosting providers (“super-hosters”) and build allowlists to reduce disruption.

Best practices

• Avoid bulk enforcement of entire feeds at the network or endpoint layer without tuning.
• Start with high-confidence subsets and expand coverage gradually.
• Combine blocking with visibility into what would have been blocked before enforcing aggressively.

Feeds: Domain Hotlist, IP Risk, IP Hotlist, Newly Active Domains, Newly Observed Domains, Newly Observed Hostnames

Threat detection

Detect when assets in your environment communicate with suspicious or high-risk infrastructure. DomainTools feeds enable early identification of threats that may evade traditional signature-based detection.

Detection patterns

• Cross-reference internal telemetry (DNS logs, proxy logs, Endpoint Detection and Response (EDR), NetFlow) against Domain Hotlist, IP Hotlist, Newly Observed Domains, and Newly Active Domains.
• Trigger alerts when entities match known or emerging suspicious infrastructure.
• Use Newly Observed Domains and Newly Active Domains to identify early-stage attack infrastructure before reputation systems catch up.

Risk-based alerting

• Ingest Domain Risk and IP Risk feeds and trigger alerts based on:
  • overall_risk
  • all_threats_combined_percent
• Prioritize alerts dynamically based on severity scoring rather than static blocklists.
• Both feeds are also consumable from agentic AI workflows via the DomainTools MCP Server, without requiring a separate enrichment pipeline.

Noise reduction

• Use IP Risk context (ASN, hosting type, usage patterns) to distinguish:
  • Commodity or shared infrastructure
  • Dedicated or suspicious infrastructure
• Suppress or de-prioritize alerts tied to known “super-hosters” where appropriate.

Feeds: Domain Hotlist, IP Risk, IP Hotlist, Newly Active Domains, Newly Observed Domains, Newly Observed Hostnames

Automated enrichment

Enhance alerts and investigation workflows with domain and IP context from DomainTools feeds.

• Query Domain Risk or IP Risk via API or feed ingestion and join on domain or IP fields in alert data.
• Add context such as:
  • Risk scores and threat distributions
  • Autonomous System Number (ASN), organization, and geolocation
  • Passive DNS resolution patterns
• Improve triage speed and consistency by embedding risk intelligence directly into analyst workflows.

Feeds: Domain Risk, IP Risk, IP Hotlist

Brand and supply chain monitoring

Identify domains and subdomains that impersonate your organization, brands, or supply chain partners to support early detection of phishing, fraud, and abuse campaigns.

Detection approach

• Use the Feed API domain filter — supported on domain-oriented feeds (Domain Risk, Domain Hotlist, Newly Observed Domains, Newly Observed Hostnames, Newly Active Domains, Domain Discovery, Parsed Domain RDAP; not IP Risk or IP Hotlist) — to retrieve targeted subsets matching your organization name, brands, or key suppliers (for example, *yourcompany* or *partnername*).
• Alternatively, ingest full feeds (Newly Observed Domains, Newly Observed Hostnames, Domain Discovery) and apply custom pattern-matching logic to detect:
  • Typosquatting (character substitution, omission, homoglyphs)
  • Keyword abuse (for example, login, secure, update, support)
  • Brand and phishing term combinations

Coverage by feed type

• Newly Observed Domains detects newly observed apex domains at first appearance in DNS.
• Domain Discovery identifies newly registered domains, including those not yet resolving.
• Newly Observed Hostnames detects abuse at the subdomain level, including:
  • Malicious subdomains on compromised infrastructure
  • Abuse on legitimate hosting platforms (for example, user-generated subdomains)

Prioritization and triage

• Prioritize domains that:
  • Are newly observed or newly registered
  • Contain high-risk keywords combined with brand terms
  • Show early DNS activity (first-seen or rapid resolution patterns)
• Enrich hits with Domain Risk or IP Risk to:
  • Prioritize higher-risk findings
  • Reduce false positives from benign brand references

Best practices

• Maintain a continuously updated watchlist of brand and supplier keywords.
• Include common misspellings, abbreviations, and homoglyph variants.
• Automate filtering and evaluation to process new domains as they appear in near real time.

Feeds: Domain Risk, IP Risk, Newly Active Domains, Newly Observed Domains, Newly Observed Hostnames

Customer-facing phishing and credential harvesting hunt

Proactively identify domains likely being used to target your customers with phishing, credential harvesting, or payment fraud campaigns.

Detection approach

• Monitor for newly registered, newly observed, or newly active domains that contain high-risk keywords commonly associated with phishing, such as:
  • login, secure, verify, auth, account, update, password
  • Financial lures: wallet, card, billing, invoice, payment
• Combine keyword matching with brand or service names (your organization, products, or partners) to identify targeted attacks.
• Apply filters using the Feed API or post-ingestion processing to continuously evaluate new domains as they appear.

Coverage by feed type

• Domain Discovery identifies newly registered domains before they are used in attacks.
• Newly Observed Domains detects apex domains at first appearance in DNS.
• Newly Active Domains surfaces domains that suddenly become active after dormancy, a common phishing pattern.
• Newly Observed Hostnames detects phishing hosted on subdomains, often on compromised or shared infrastructure.
• Domain Hotlist provides curated high-confidence phishing and abuse indicators.

Prioritization and triage

• Prioritize domains that:
  • Are newly registered or newly observed
  • Contain both brand terms and phishing keywords
  • Exhibit early DNS resolution or sudden activation behavior
• Enrich results with Domain Risk or IP Risk to:
  • Prioritize higher-risk domains
  • Identify infrastructure commonly linked to phishing campaigns

Best practices

• Maintain a keyword library tailored to your customer workflows (for example, login flows, billing terms, product names).
• Include common variations and synonyms used in phishing lures.
• Continuously tune filters to balance coverage and noise.
• Automate ingestion and filtering to ensure near real-time visibility into emerging threats.

Feeds: Domain Hotlist, Newly Observed Domains, Newly Active Domains, Newly Observed Hostnames, Domain Discovery

DGA domain detection

Identify domains generated by a domain generation algorithm (DGA), used by malware for command-and-control (C2), data exfiltration, and fallback communication.

Detection approach

• Continuously monitor feeds for bursts of newly active or newly observed domains, a common pattern associated with DGA-based infrastructure.
• Apply DGA detection logic to domain strings, including:
  • High entropy or randomness
  • Unusual character distribution or length
  • Lack of recognizable language patterns
• Ingest feeds via API or data pipelines and automate analysis to evaluate domains in near real time.

Coverage by feed type

• Newly Active Domains detects domains that suddenly become active after dormancy, a strong signal of DGA activation patterns.
• Newly Observed Domains identifies previously unseen apex domains appearing in DNS for the first time.
• Newly Observed Hostnames surfaces subdomains that may be generated dynamically as part of DGA activity.
• Domain Discovery identifies newly registered domains before they are used in attacks.

Detection signals

• Bursts of domains appearing within short time windows
• Domains with similar structural patterns (length, character sets, prefixes or suffixes)
• Low historical presence combined with sudden DNS activity
• Repeated resolution attempts from endpoints to multiple similar domains

Prioritization and triage

• Prioritize domains that:
  • Appear in clusters or bursts
  • Exhibit strong DGA-like string characteristics
  • Are queried repeatedly by a single endpoint or small group of hosts
• Enrich findings with Domain Risk or IP Risk to:
  • Identify known malicious infrastructure tied to DGAs
  • Differentiate benign high-entropy domains from malicious ones

Best practices

• Combine string-based DGA detection with behavioral signals (query patterns, timing, frequency).
• Avoid relying solely on lexical analysis, as modern DGAs may mimic natural language.
• Continuously tune detection thresholds to balance false positives and missed detections.
• Correlate with endpoint telemetry to identify infected hosts early.

Feeds: Newly Active Domains, Newly Observed Domains, Newly Observed Hostnames, Domain Discovery

Related resources

• Threat Feeds overview
• Data retrieval patterns
• Domain Risk
• IP Risk
• Domain Hotlist
• IP Hotlist