Gridinsoft Domain Intelligence Back to feeds overview

Integration reference

Domain Intelligence CSV reference

Field definitions and handling guidance for the 11-column Domain Intelligence export. Use the category, indicator context and recommended action together when integrating a record into your workflow.

Download example CSV

The 11 CSV fields

Fields appear in the order below. The export does not include a separate confidence probability or an inline evidence summary; use the report link for additional context.

domain
The normalized domain or fully qualified hostname being assessed. This is not a URL or a URL-path indicator.
category
The exported classification, such as Phishing, Malicious, Financial Scam or Suspicious Shop.
risk_score
A 0–100 integer risk indicator derived from the stored assessment, with category-based fallbacks. Higher means higher assessed risk, not a measured probability of maliciousness or an independent confidence score. A high score does not override a review or enrich recommendation.
indicator_context

Distinguishes direct threats, browser abuse, reputation signals and infrastructure or namespace exclusions. Use it alongside the action, not as proof that an entire platform is malicious.

Values: direct_threat, browser_abuse, reputation_signal, abused_infrastructure, restricted_public_namespace and dns_excluded_service.

recommended_action
block: candidate for enforcement under your policy. monitor: observe activity. review: investigate a reputation signal. enrich: contextual use, not blanket DNS blocking. See actions and profiles below.
first_seen
First-seen timestamp in our current dataset. This is not the domain registration date or necessarily the start of malicious activity.
last_seen
Timestamp of the current stored verdict. This is not a last DNS query, last live observation or snapshot publication time.
last_scanned
Timestamp of the most recent locally stored website report. It does not certify a successful page fetch or fresh results from every external provider.
evidence_updated_at
Currently mirrors last_seen, the stored-verdict timestamp. It is not an independent evidence-refresh timestamp.
tranco_rank
Rank from the local Tranco snapshot when available. A blank value is missing rank data, not evidence of maliciousness; a populated rank is not an allow-list decision.
report_url
A link to the website report for follow-up and investigation. The linked report may change after the snapshot is published.

Read each timestamp in context

CSV timestamps use YYYY-MM-DD HH:MM:SS in the feed’s configured timezone, currently Europe/Kyiv, without a numeric offset. Account for that timezone when parsing or comparing dates.

Snapshot publication, stored-verdict updates and locally stored website reports are different events. A recently published snapshot does not mean that every domain was just rechecked, and a recent report date does not guarantee that every external source was refreshed.

evidence_updated_at currently equals last_seen. Treat these as the same stored-verdict timestamp, not two independent freshness signals.

Actions and delivery profiles

Preserve the hostname scope and action context. A domain assessment does not mean that every URL or subdomain is malicious.

block
A candidate for enforcement under your own policy and chosen delivery profile.
monitor
Observe activity and use the record as context for monitoring.
review
Investigate a reputation signal; do not convert it into an automatic block solely because its risk score is high.
enrich
Use the record for contextual enrichment, not blanket DNS blocking of shared infrastructure or excluded namespaces and services.

Domain Intelligence

Broader domain and FQDN context across phishing, malware, scam, suspicious and browser-spam streams.

  • Includes block, monitor, review and enrich recommendations.
  • The Suspicious stream is non-blocking reputation intelligence for review.
  • Browser Spam includes both blocking and monitor-only rows.
  • Known shared-infrastructure indicators are marked for contextual enrichment.

DNS Enforcement

A separately selected snapshot for domain-level blocking workflows.

  • Includes phishing, malware, scam and browser spam selected for blocking.
  • Excludes the Suspicious stream and monitor-only browser spam.
  • Excludes known shared platforms and infrastructure, restricted public-sector namespaces and services covered by the DNS-exclusion policy.

Validate the selected profile against your own traffic before enabling customer-facing blocking. Rescans, analyst corrections and export policy can change a record’s classification, action or inclusion.

Download, replace, match locally

Feeds are delivered as full snapshots over authenticated HTTPS in CSV or GZIP-compressed CSV. Snapshots are generated hourly; the delivery model does not provide add/remove deltas.

  1. Download the current snapshot for the agreed feed and profile.
  2. Replace the previous snapshot rather than only appending new rows. Refresh changed classifications and recommended actions as well as newly added domains.
  3. Remove indicators that are no longer present from enforcement based on this feed. A missing domain means there is no match in that snapshot; it does not certify the domain as safe.
  4. Match domains inside your own environment without submitting each lookup to Gridinsoft. Optional API lookups and visits to online reports are separate requests.

About the downloadable example

The example CSV follows this 11-column schema and uses actual export labels. Its .example domains, report URLs, scores and dates are synthetic illustrations, not live detections or measured coverage. The example report URLs are placeholders, not working reports.

The sample shows records across all five intelligence streams, including a Suspicious Shop record recommended for review, shared-infrastructure context for enrichment, and both blocking and monitor-only Browser Spam records.