Your stack already sees the domains: in DNS requests, proxy events, email links and product checks. The next decision is what to do with them. A phishing destination needs an enforcement path. A suspicious storefront belongs in a review queue. An abused hosting platform needs infrastructure context so the response stays focused on the relevant hostname.
Gridinsoft Domain Intelligence feeds bring that decision context into your environment. Each record combines a domain or fully qualified hostname with a category, risk score, recommended action, infrastructure context, assessment dates and a link to the website report. Your product or security team matches locally and applies its own policy.
For security vendors, protective DNS providers and SOC/MSSP teams, this creates a practical route from external research to operational use: import structured intelligence, connect it to the activity you already observe, and route the finding to the right protection or investigation workflow.
Why Gridinsoft: website analysis becomes usable intelligence
The Gridinsoft Trust Model brings together website content and behavior, domain history and infrastructure context, threat research and reputation signals. Those inputs inform an assessment that your integration receives as structured fields.
Consider a site presenting an account portal. What the page claims to represent, what credentials it requests and how the interaction behaves provide website-level context. Domain history, hosting context and reputation signals contribute to the assessment. The resulting feed record carries the classification and recommended treatment; the linked report gives an analyst a place to examine the website assessment.
This connection matters inside a product. Your policy engine receives fields it can evaluate immediately, while your analyst receives a route into the analysis. A phishing classification with direct_threat context and a block recommendation supports a different workflow from a Suspicious Shop record marked reputation_signal and review.
The five streams cover phishing, malware, scam, browser spam and suspicious/reputation findings. That scope puts credential theft, fraudulent offers and notification abuse into the same integration format. Your team chooses the streams relevant to its users and maps the supplied categories and recommendations into product behavior.
Choose the profile for the decision you make
Domain Intelligence supplies broad context for security products, enrichment and investigation. It includes all five streams and four recommendations: block, monitor, review and enrich. Suspicious findings enter review workflows. Browser spam includes both blocking and monitoring records. Infrastructure indicators supply context for enrichment.
DNS Enforcement is a separately selected profile for protective DNS and domain blocking. It contains phishing, malware, scam and browser-spam records selected for enforcement. Its selection excludes the Suspicious stream, monitor-only browser spam, known shared platforms and infrastructure, and namespaces or services covered by the DNS-exclusion policy.
The distinction addresses a real engineering decision: the scope of a domain block. Shared infrastructure can be useful to an investigation while requiring different treatment at a resolver. Gridinsoft carries that distinction into the profile selection and record context, giving your team a foundation for targeted policy.
Three integrations that turn context into action
Security products: give domain checks a useful next step
Start with the hostname your web-protection service or application already checks. Match it against the local Domain Intelligence dataset and read category, indicator_context and recommended_action together. Use risk_score as an additional risk indicator within that policy.
A phishing match recommended for blocking can enter your credential-protection path. A financial-scam finding can drive a fraud-specific decision and explanation. A browser-spam record can enter either enforcement or monitoring according to its action. Suspicious-shop findings go to your reputation-review workflow, with the report link attached for examination.
The outcome is differentiated product behavior from one ingestion pipeline. Your team controls the user experience and policy thresholds; Gridinsoft supplies the domain assessment and the fields needed to route it. The same record also gives support or research teams a common reference when they examine a user-visible decision.
Protective DNS and gateways: build a focused enforcement set
For a DNS provider or secure gateway, start with the DNS Enforcement profile. Import the snapshot, retain the supplied hostname scope and translate selected records into your platform’s domain-rule format. Apply your customer policy and exceptions at that stage.
The profile’s infrastructure exclusions are valuable here: they address shared platforms before the dataset reaches your blocking workflow. Preserve exact fully qualified hostnames through conversion so a tenant-level indicator stays attached to that tenant. Category and context remain available for rule explanations and operational review.
On the next import, replace the feed-derived rules with the current set. Changed recommendations take effect, and withdrawn records leave that feed’s enforcement contribution. Keep source attribution on each rule so other intelligence sources and your own rules retain their independent policy decisions. The result is an enforcement set with a defined refresh lifecycle.
SOC and MSSP teams: attach context to the events you investigate
Extract domains from your own DNS, proxy and email telemetry, then join them to the local Domain Intelligence table. Add the matched category, action, context, risk score and report URL to the event or case. Keep the observed user, asset and event time from your telemetry alongside those fields.
That join gives a triage workflow something concrete to work with. A phishing match on a sensitive user’s browsing event can enter a credential-exposure investigation. Repeated browser-spam matches can be grouped for browser-abuse review. An infrastructure indicator marked enrich adds context to a case, while a suspicious storefront marked review enters a reputation investigation.
An analyst follows report_url to inspect the website report and records a disposition in the case. An MSSP can reuse the ingestion and enrichment pipeline across tenant-specific policies, with access and routing handled inside its own environment. These are integration patterns your team implements through its SIEM, SOAR or data pipeline.
Request a 30-day PoC to test the profile and workflows that match your product or operational environment.
One snapshot pipeline, four action routes
Feeds arrive over API-key authenticated HTTPS as full CSV or GZIP-compressed CSV snapshots, published hourly. Load the data into your own environment and perform domain matching there. Your lookup workload stays local, and your team chooses how to combine Gridinsoft with existing sources.
The schema has 11 fields: domain, category, risk_score, indicator_context, recommended_action, first_seen, last_seen, last_scanned, evidence_updated_at, tranco_rank and report_url.
Build the import around replacement. Download to a staging area, validate the header and values, and load a temporary table. Compare additions, removals and changed fields with the active version, then switch the local dataset atomically. Retain the previous validated snapshot for rollback and log the version used for each decision.
The following pseudocode shows the integration sequence. The endpoint and policy functions belong to your deployment; phishing.example is a synthetic hostname.
snapshot = download(configured_feed_endpoint, api_key)
staging = parse_csv_or_gzip(snapshot)
validate_schema_and_values(staging)
changes = compare(active_dataset, staging)
atomic_replace(active_dataset, staging)
reconcile_feed_rules(changes, customer_policy)
record = exact_hostname_match("phishing.example", active_dataset)
if record exists:
context = (record.category, record.indicator_context, record.risk_score)
route(record.recommended_action, context, customer_policy)
attach_report_link(record.report_url)
Map block to your enforcement evaluation, monitor to observation, review to an analyst queue and enrich to contextual attachment. Keep the action and infrastructure context intact as records move downstream. Reconcile removed rows as well as new ones so the local policy reflects the current snapshot.
Use the assessment dates for record inspection and your ingestion log for snapshot versioning. Parse CSV timestamps in the documented Europe/Kyiv timezone. The field reference defines each timestamp and value; the sample CSV gives engineers concrete rows for all five streams, including review, enrichment and browser-spam monitoring.
Make the 30-day PoC answer a buying decision
For a detection lead or CISO, the evaluation should connect data quality to operational value. Pick one product check or telemetry pipeline, name the decisions you want to improve, and compare Gridinsoft alongside your current sources.
Measure additional relevant coverage. Count domains present in Gridinsoft and absent from your comparison set, then identify which appear in your own traffic or product checks. Break those findings down by category and action to show where the additional context matters.
Review the resulting decisions. Sample the matches, inspect their reports and record analyst dispositions, including false positives and policy exceptions. Separate raw match counts from findings that produced a useful investigation, review outcome or enforcement decision.
Track operational effort. Record the engineering work required for ingestion, snapshot replacement and policy mapping, then measure analyst handling effort during the trial. Exercise changed and removed records so the evaluation covers ongoing operation as well as the first successful import.
This produces a practical production proposal: the profile and streams you need, the workflows they support, the findings relevant to your environment and the work required to run the integration.
Bring Gridinsoft intelligence into your stack
Give your security product and analysts domain intelligence they can put to work: website-informed assessments, clear action routes, infrastructure context and a report behind the finding. Start your 30-day Gridinsoft Domain Intelligence PoC. Tell us about your product, preferred profile and intended deployment, and we will agree the evaluation scope and provide access and integration documentation.
