Domain intelligence
for security products.
Domain datasets for antivirus vendors, cybersecurity companies and security researchers. Match threat and reputation records in your own systems.
30-day evaluation for security vendors, protective DNS and security teams.
Website content
and behavior analysis.
Gridinsoft data
in the security ecosystem.
Classification and context
for each indicator.
Each indicator combines a website assessment, infrastructure context, a recommended action and a link to the analysis report.
- 1Page identity
What the page claims to be.
- 2Credential requests
What it asks the visitor to share.
- 3Page behavior
How the interaction is presented.
Treatment of hosting.example
indicator_contextabused_infrastructureAn abused tenant is not a reason to block an entire platform.
- category
- Phishing
- indicator_context
- direct_threat
- recommended_action
- block
- risk_score
- 95 / 100
- last_scanned
- 2026-10-20 08:30
- report_url
- Analysis report
Use the category and infrastructure context.
Use the action recommendation in your own workflow.
Inspect assessment dates and open the linked report.
Threat categories
and feed records.
From credential theft to investment fraud and browser abuse. Explore the streams and the context delivered with each record.
Phishing domains
and impersonation.
Credential theft and impersonation targeting accounts, identities and payment details. Add domain-level findings to your protection and investigation workflows.
Example snapshot · 21 Oct 2026, 16:20 UTC
195,490 records across five streams
Preview data; current feed totals vary.
The assessment behind the indicator, so you can route it to the right protection or investigation workflow.
Two profiles for
different integration needs.
Use Domain Intelligence for research and enrichment, or DNS Enforcement for a selection intended for protective DNS and domain-blocking products.
Domain intelligence
for research and enrichment.
A broad intelligence profile for security products and analysts. Combine threat findings, reputation signals and infrastructure context with your own sources.
Download snapshots.
Match domains locally.
Download full CSV or GZIP snapshots over HTTPS and match domains locally. Apply your policy without sending each lookup to Inspector.
Read the integration reference- 01Connect securelyAPI-key authenticated HTTPS↗
- 02Fetch your snapshotFull CSV or GZIP · published hourly↓
- 03Apply your policyLocal matching · product enrichment · DNS✓
Evaluate the feed
with your own data.
Compare Gridinsoft with your existing sources. Review relevant findings, coverage differences and integration requirements for your product.
Evaluation
criteria.
API access + integration documentation
Evaluation scope agreed together.
Feed format, updates and licensing.
What does the feed contain?+
Domain and fully qualified hostname indicators, with categories, risk scores, recommended actions, infrastructure context, assessment dates, Tranco rank where available and report links. Five threat and reputation streams use the same 11-field CSV schema.
How often is it updated?+
Full snapshots are published hourly. Download CSV or GZIP and replace the previous snapshot. Record-level timestamps let you inspect the timing of individual assessments.
Can we integrate it into our commercial product?+
Yes. Commercial licensing is scoped to your products and intended use. We’ll agree the evaluation scope first, then discuss the production licence that fits your deployment. Feed licensing is separate from API credit plans.
GRIDINSOFT / BUSINESS SOLUTIONS
Feed evaluation
and DNS protection
Request a domain feed evaluation or discuss DNS protection for your company’s network.