DomainTools

DomainTools is a DNS-focused threat intelligence platform that helps security teams detect, investigate, and block malicious domains. It draws on passive DNS data, historical Whois and RDAP records, SSL certificate and hosting context, and a predictive Risk Score to surface risky domains early and map connected adversary infrastructure.

The platform offers an investigative UI and an API for enrichment at scale, along with real-time threat feeds and monitoring for domains targeting an organization or brand. It supports flexible search and filtering, guided pivots between DNS identifiers, and historical analysis across DNS resolutions, IP addresses, and name servers. Integrations cover SIEM, SOAR, TIP, E/XDR, and LLM platforms, including Splunk, Microsoft Sentinel, IBM QRadar, Elastic, Cortex XSOAR, CrowdStrike, Recorded Future, and ServiceNow. The product also provides an MCP interface for AI SOC workflows and IrisQL for threat investigations.

DomainTools is aimed at analysts, incident responders, and threat hunters across threat intelligence and hunting, forensics and incident response, fraud prevention, brand protection, law enforcement, and OEM use cases, serving enterprises, governments, and security platforms. Packaging details such as free plans, trials, editions, or seat-based and usage-based pricing are not stated on these pages.