Strengthen network defenses
Match DNS and gateway activity against threat intelligence. Use the DNS Enforcement profile to support blocking decisions and investigate the domains behind alerts.
Turn domain risk into decisive action.
Put Gridinsoft domain intelligence to work in your security products and operations. Detect malicious destinations, enrich alerts with threat context, and prioritize the findings that need action.
- Five intelligence streams covering phishing, malware, scams, suspicious destinations, and browser spam.
- Threat categories, recommended actions, and analysis dates to support each decision.
- Local matching for security platforms, network defenses, and analyst workflows.
Contact us
Tell us what you want to evaluate or put into production. We will help you choose the product, capacity and applicable licence.
Put domain intelligence to work.
Equip network defenders, SOC teams, and security product builders with domain assessments they can act on. Classification, context, and follow-up support each workflow.
Give analysts a starting point
Enrich SIEM events and investigation queues with a category, risk score, recommended action, and report link. See which findings call for review or monitoring.
Power your security product
Add domain threat intelligence to a security platform or managed service. Use structured findings to drive alerts, policy decisions, and investigation views under a commercial license.
See the threats that shape the web.
Cover credential theft and harmful downloads alongside fraud, unwanted applications, and browser abuse. Distinct categories help your team explain the kind of risk it has found.
Phishing
Domains associated with credential theft and impersonation.
Malware
Domains associated with malware distribution and harmful downloads.
Scam
Financial, crypto, investment, hiring, raffle, and general scams.
Suspicious
Adware, unwanted applications, suspicious shops, and suspicious dating sites.
Browser spam
Browser notification abuse, with recommendations for blocking or monitoring.
Choose the intelligence your decisions need.
Two delivery profiles serve different operational needs. We help you select the scope that fits your product and the way your team acts on findings.
Domain Intelligence
Broader context for analysts, security platforms, and managed service providers.
- All five intelligence streams, including suspicious activity.
- Recommendations for blocking, monitoring, review, or enrichment.
- Domain context, analysis dates, and links for follow-up.
- Local matching across your licensed security workflows.
DNS Enforcement
A dedicated selection for teams making domain-level blocking decisions.
- Phishing, malware, scam, and selected browser spam indicators.
- Scope tailored to DNS protection workflows.
- Context for investigating and explaining a block.
- Hourly snapshots for ongoing policy updates.
Give every finding a useful next step.
Download an illustrative CSV sample · Plan your data evaluation
The sample uses reserved example domains and a subset of delivery fields. It demonstrates the format, not live detections or measured coverage. Ask for evaluation access to assess real data; the agreed delivery profile defines the full schema.
The value is in the combination: what the risk is, how to handle it, when it was assessed, and where an analyst can look next.
A record your team can work with
- Domain
- download.example
- Category
- Unwanted App
- Recommended action
- Review
- Analysis context
- Risk score and relevant dates
- Follow-up
- Link to the domain report
Illustration only. Available context depends on the record and delivery profile.
Classify. Prioritize. Explain.
Classification
Tell a phishing finding from a scam or an unwanted application, and apply the appropriate response.
Action
Use the recommended action to guide blocking, monitoring, review, or enrichment.
Freshness
Assess a finding using its analysis and evidence dates. Hourly delivery does not mean every domain was rescanned that hour.
Follow-up
Open the linked report when your team needs more context for investigation or incident triage.
Bring the intelligence into your workflow.
Match locally. Monitor repeatedly.
Receive hourly snapshots in CSV or compressed CSV. Match against domains in your own environment without sending each domain to Gridinsoft.
Use feeds for network traffic matching, security event enrichment, and threat hunting across your licensed deployment.
Add targeted checks when needed.
Combine local feed matching with individual checks when an investigation needs more information.
Explore the Domain Reputation API for domain assessments and the URL Scanner API for URL analysis. API access and usage terms are agreed separately.
A commercial license built around your use.
License Gridinsoft intelligence for internal security operations, a managed service, or a customer-facing product. Feed pricing is quoted separately from public API credit plans.
Define your use
Tell us about your security product or environment, the coverage you need, and how you plan to use the intelligence.
Evaluate the fit
Assess relevant coverage, the usefulness of findings, and integration effort in your own workflow before choosing a production license.
Agree the rights
Set the delivery scope, integration rights, retention, attribution, and support requirements in your commercial agreement.
Questions before you get started
How often are feeds updated?
Full feed snapshots are published hourly. Each record includes dates that help your team assess the age of its underlying analysis. Snapshot publication time and analysis time are different.
Can we integrate the feeds into a commercial product?
Commercial licensing is available for security products, managed services, and enterprise deployments. Your agreement defines the permitted integration, usage rights, retention, and attribution. Contact us to scope the license for your use case.
Where does domain matching take place?
You can download the licensed feeds and match domains within your own environment, without submitting each domain to Gridinsoft. Optional API lookups and visits to online reports are separate requests.
Does a domain missing from a feed mean it is safe?
No. It means there is no match in that feed snapshot. Feeds identify covered threats and reputation signals; they do not certify every other domain as safe. Domain and URL APIs are available for additional checks.
Should we choose feeds or the API?
Choose feeds for local matching across network traffic, security events, or threat hunting workflows. Choose the API for individual domain or URL checks. The two can be combined when your workflow needs both.
How are feeds priced and evaluated?
Feed licensing is quoted separately from public API credit plans, based on the agreed scope and usage rights. Evaluation access is available so you can assess relevance and integration fit before choosing a production license.
Evaluate it in your own environment.
Tell us about your security product, operations, or protection workflow. We’ll help you choose a feed profile, define an evaluation, and scope a commercial license.
Contact us
Tell us what you want to evaluate or put into production. We will help you choose the product, capacity and applicable licence.