title: DomainTools Domain Risk Score
service_id: domain-risk-score
auth_types: API Key, HMAC Signature
source_url: https://docs.domaintools.com/riskscore/
api_specification: https://docs.domaintools.com/api/lookups-monitors/lookups-monitors-openapi.yml

## Overview

Domain Risk Score is DomainTools' real-time domain threat assessment system. It combines machine learning classifiers (Threat Profile) with infrastructure proximity analysis (Proximity) to produce a 0–100 risk score for any domain.

The score is the highest of four components: Proximity, Malware Risk, Phishing Risk, and Spam Risk. Threat Profile scores apply to domains 28 months old or younger. Proximity scores update rapidly in response to DNS infrastructure changes. All active domains are scored daily.

## Key Capabilities

- Threat Profile: ML classifiers for malware, phishing, and spam intent
- Proximity: Infrastructure-based risk from association with known-malicious domains
- Realtime scoring: Provisional scores within minutes of domain discovery; full scoring within 15–20 minutes
- Dynamic re-scoring: Scores update when significant DNS or attribute changes are detected
- Two API endpoints: /v1/risk/ for high-volume enrichment; /v1/risk/evidence/ for investigation with detailed evidence

## Score Ranges

- 0: Zero-listed (known-good)
- 1–99: Active risk scoring range
- 100: Allow-listed

## Related Resources

- Domain Risk Score is integrated into all Iris products (Investigate, Enrich, Detect)
- Threat Feeds include risk-scored domain and IP hotlists: https://docs.domaintools.com/api/threat-feeds/
- Full Lookups and Monitors API reference: https://docs.domaintools.com/api/lookups-monitors/api-reference.html

## This Documentation

This reference covers the Domain Risk Score concept (components, scoring methodology, score ranges, and access methods) and the two API endpoints: Domain Risk Score (/v1/risk/) and Risk Score Evidence (/v1/risk/evidence/), including parameters, sample responses, and response field descriptions.

---

## Introduction

Domain Risk Score uses a real-time, historical database of observed changes in domain names, registrations, and infrastructure values. This industry-leading data enables best-in-class analysis. The system estimates a domain's observed connections to known-bad actors with Proximity, and its predicted risk with the Threat Profile suite of machine learning classifiers.

The Threat Profile uses machine learning classifiers to estimate the probability that someone registered a domain with malicious intent for malware, phishing, and/or spam. DomainTools continuously refines these machine learning classifiers against changes in the global Domain Name System (DNS) and the malicious domain landscape, drilling down to the signals—out of hundreds—most important for predicting malice.

The Proximity score measures a domain's observed closeness to known malicious domain infrastructure. DomainTools enriches known-bad domains with its own data, and reveals the innocent-looking domains to which they're linked. The proximity score updates rapidly in response to changes in global DNS infrastructure.

You can access Domain Risk Score through DomainTools products for security automation and investigation.

## Domain Risk Score components

### Domain Risk Score field names and valid values

| Domain Risk Score Component | Field Name | Valid Values |
| :-------------------------- | :--------- | :----------- |
| Domain Risk Score Highest of malware_risk, phishing_risk, spam_risk, and proximity | overall_score | 0-100 |
| Malware Risk | malware_risk | 0-100 \| null |
| Phishing Risk | phishing_risk | 0-100 \| null |
| Spam Risk | spam_risk | 0-100 \| null |
| Proximity | proximity | 0-100 |

## Threat profile: malware, phishing, and spam

The Threat Profile consists of three components:

- malware_risk: A machine learning algorithm tuned to look for malware-related domains: domains used as part of malware hosting, dropping, command-and-control, or other activities.
- phishing_risk: A machine learning algorithm tuned to look for phishing-related domains: domains which may try to deceive a user by pretending to represent a product or service to perform malicious activities against a user.
- spam_risk: A machine learning algorithm tuned to look for spam-related domains: domains part of spam email creation, distribution, or tracking.

Each component uses a set of machine learning classifiers that predict if someone registered a domain with malicious intent. The classifiers assess the similarity between a domain's inherent characteristics and those associated with phishing, malware, and spam. The Threat Profile Score only applies to domains of an age of 28 months or younger.

### Realtime risk scoring

DomainTools provides realtime risk scoring for newly discovered domains:

- Provisional scoring: Initial proximity and phishing risk scores are available within a few minutes of domain discovery
- Full risk scoring: Complete risk scoring across all 4 algorithms—proximity, phishing, malware, and spam—is typically available within 15-20 minutes of discovery
- Dynamic re-scoring: The system updates risk scores when it detects significant changes to a domain's DNS records or other attributes
- Daily scoring: The system continues to score all active domains daily to ensure up-to-date risk assessments

Each Threat Profile component scores 1-99 or null:

- Threat profile component scores of null show that the domain has aged out of a threat profile.
- The system reserves scores of 0 and 100 for zero-listing and allow-listing, respectively. Consult Domain Risk Score ranges, below.

## Proximity

The proximity score quantifies the closeness of a domain to known-malicious domains. It shows the likelihood that a domain has malicious intent, based on signals from the domain's registration details and hosting infrastructure.

The proximity score calculates between 1-99. The system reserves scores of 0 and 100 for zero-listing and allow-listing, respectively. Consult Domain Risk Score ranges, below.

Proximity assigns risk much like a human investigator: looking at the connections domains have to each other. For example, if a large percentage of domains on a given Internet Protocol (IP) address are malicious, Proximity assumes the other domains on that IP address are also malicious.

## How the system calculates the Domain Risk Score

The Domain Risk Score takes the highest of Threat Profile components and Proximity. Threat Profile takes the highest of Phishing, Malware, and Spam.

In the following example, the Domain Risk Score inherits 81 from Malware:

- Domain Risk Score: 81
  - Proximity: 23
  - Malware: 81
  - Phish: 69
  - Spam: 1

## Domain Risk Score ranges

| Score Range | Score Color | Description |
| :---- | :---- | :---- |
| 100 | Red | Blocklisted. These domains can be considered known-bad, and have the highest likelihood of malicious intent. This includes sinkholed domains. DomainTools combines third party blocklists with our own scoring to determine which domains to blocklist. |
| 90-99 | Red | Strong confidence in near-term weaponization. |
| 70-89 | Orange | A potential threshold for suggesting malicious intent, and our default recommendation for significance in an investigation. Individual mileage may vary, depending on your security context and priorities. |
| 50-69 | Yellow | May require attention, depending on your security posture. |
| 1-49 | Grey | Very little evidence of malicious intent. |
| 0 | Grey | Zero-listed. DomainTools zero-lists a domain when we have no evidence that it was registered with malicious intent. Zero-listing guards well-known legitimate domains against accidental blocking and includes domains which are vital to the expected operation of the Internet. |

Note that DomainTools doesn't assess or condone the quality of the content hosted on scored domains.

No component of the Domain Risk Score definitively confirms malicious activity–because threat actors may register many domains but use only a few for malicious purposes.

## Using the Domain Risk Score

The Domain Risk Score is fully integrated into the suite of Iris products: investigate, enrich, and detect.

### Iris Platform: user interface and API

The Domain Risk Score is fully integrated into the DomainTools family of Iris products: investigate, Enrich, and Detect. Risk scores appear for all active domains both in the user experience of the web app as well as in all Iris APIs.

### Risk score API endpoints

The Domain Risk Score also has its own API endpoints. Iris API products include Domain Risk Score. Consult the API documentation for more information.

- Domain Risk Score API — returns scores and component scores for high-volume enrichment
- Risk Score Evidence API — returns scores with detailed evidence for investigation

### Threat Feeds

Threat intelligence feeds offer risk scoring. Consult the Real-time and Daily Threat Feeds.

### Integrations

Third-party integrations, such as Splunk, include Domain Risk Score. Consult the Integrations page for more information.

```text
https://api.domaintools.com/v1/risk/
```

The /v1/risk/ endpoint returns a domain's overall risk score and component scores. It is designed for large-scale enrichment and triage within custom tools or DomainTools SIEM/TIP integrations, and supports a higher query rate than the Risk Score Evidence API.

For detailed evidence behind a domain's risk score, use the Risk Score Evidence API (/v1/risk/evidence/).
Note: Example domain
The examples on this page use example.com. To test with high-risk domains, use Iris Investigate or the Domain Hotlist feed to find currently active domains with elevated risk scores.

## Parameters

| Parameter | Description |
| --------- | ----------- |
| domain | Required. The domain to query. If you provide a hostname (for example, www.domaintools.com) rather than a domain (for example, domaintools.com), the API attempts to return the risk score for the domain. The response always includes the domain used for the lookup. |

## Sample response

The following sample is illustrative. Actual responses vary by domain — see Response structure for details.

```json
{
    "response": {
        "domain": "example.com",
        "risk_score": 95,
        "components": [
            {
                "name": "proximity",
                "risk_score": 63
            },
            {
                "name": "threat_profile",
                "risk_score": 95
            },
            {
                "name": "threat_profile_phishing",
                "risk_score": 3
            },
            {
                "name": "threat_profile_malware",
                "risk_score": 3
            },
            {
                "name": "threat_profile_spam",
                "risk_score": 95
            }
        ]
    }
}
```

## Response fields

| Field | Type | Description |
| ----- | ---- | ----------- |
| domain | string | The apex domain queried. |
| risk_score | integer | Overall risk score, 0–100. The highest of all component scores. |
| components | array | Risk components contributing to the overall score. Each object contains a name and risk_score. |

### Response structure

The components array varies depending on the domain's risk state:

| Domain state | Components returned |
| ------------ | ------------------- |
| Zero-listed (score 0) | zerolist only |
| Low risk, no threat profile | proximity only |
| Active risk | All five: proximity, threat_profile, threat_profile_phishing, threat_profile_malware, threat_profile_spam |

### Component names

| name value | Description |
| ------------ | ----------- |
| proximity | Risk based on proximity to known threats or suspicious infrastructure. |
| threat_profile | Aggregate risk score from machine learning models. |
| threat_profile_malware | ML classifier for malware-related domains. |
| threat_profile_phishing | ML classifier for phishing-related domains. |
| threat_profile_spam | ML classifier for spam-related domains. |
| zerolist | Domain is on a known-good list. Score is always 0. |

## More information

Consult the Domain Risk Score documentation for more information on interpreting risk scores and understanding score components.

```text
https://api.domaintools.com/v1/risk/evidence/
```

The /v1/risk/evidence/ endpoint provides the reasons behind a domain's risk score, categorized by evidence type. Use this endpoint for deeper investigation of individual domains.

For high-volume enrichment and triage, use the Domain Risk Score API (/v1/risk/), which supports a higher query rate.
Note: Example domain
The examples on this page use example.com. To test with high-risk domains, use Iris Investigate or the Domain Hotlist feed to find currently active domains with elevated risk scores.

## Parameters

| Parameter | Description |
| --------- | ----------- |
| domain | Required. The domain to query. If you provide a hostname (for example, www.domaintools.com) rather than a domain (for example, domaintools.com), the API attempts to return the risk score for the domain. The response always includes the domain used for the lookup. |

## Sample response

The following sample is illustrative. Actual responses vary by domain — see Response structure for details.

```json
{
    "response": {
        "domain": "example.com",
        "risk_score": 95,
        "components": [
            {
                "name": "proximity",
                "risk_score": 63,
                "evidence": [
                    "registrant"
                ]
            },
            {
                "name": "threat_profile",
                "risk_score": 95,
                "threats": [
                    "spam"
                ],
                "evidence": [
                    "name server",
                    "registrant",
                    "registrar"
                ]
            },
            {
                "name": "threat_profile_phishing",
                "risk_score": 3
            },
            {
                "name": "threat_profile_malware",
                "risk_score": 3
            },
            {
                "name": "threat_profile_spam",
                "risk_score": 95,
                "threats": [
                    "spam"
                ]
            }
        ]
    }
}
```

## Response fields

### Top-level fields

| Field | Type | Description |
| ----- | ---- | ----------- |
| domain | string | The apex domain queried. |
| risk_score | integer | Overall risk score, 0–100. |
| components | array | Risk components contributing to the overall score. Each component includes an evidence array explaining the score. |

### Response structure

The components array varies depending on the domain's risk state:

| Domain state | Components returned |
| ------------ | ------------------- |
| Zero-listed (score 0) | zerolist only |
| Low risk, no threat profile | proximity only |
| Active risk | All five: proximity, threat_profile, threat_profile_phishing, threat_profile_malware, threat_profile_spam |

### Component objects

Each object in the components array contains the following fields:

| Field | Type | Description |
| ----- | ---- | ----------- |
| name | string | Component identifier. See Component types. |
| risk_score | integer | Risk score for this component, 0–100. |
| evidence | array of strings | Evidence types supporting the score. Present on proximity and threat_profile when evidence is available. See Evidence types. |
| threats | array of strings | Threat categories detected. Present on threat_profile and its sub-classifiers when threats are detected. Possible values: phishing, malware, spam. |

### Component types

| Component | name value | Description |
| --------- | ------------ | ----------- |
| Proximity | proximity | Risk based on proximity to known threats or suspicious infrastructure. |
| Threat Profile | threat_profile | Aggregate risk score from machine learning models. |
| Threat Profile: Malware | threat_profile_malware | ML classifier for malware-related domains. |
| Threat Profile: Phishing | threat_profile_phishing | ML classifier for phishing-related domains. |
| Threat Profile: Spam | threat_profile_spam | ML classifier for spam-related domains. |
| Zero-listed | zerolist | Domain is on a known-good list. Score is always 0. |

### Evidence types

The evidence array contains strings identifying the factors behind a component's score. Observed values include:

| Evidence value | Description |
| -------------- | ----------- |
| age | Domain age characteristics. |
| domain name | Lexical properties of the domain name. |
| infrastructure | Hosting or DNS infrastructure signals. |
| ip address | IP address associations. |
| name server | Name server associations. |
| registrant | Registrant information or patterns. |
| registrar | Registrar associations. |
| registration | Registration characteristics. |

## More information

Consult the Domain Risk Score documentation for more information on interpreting risk scores and understanding score components.