Filter DNS by what a domain is, then by how risky it is.
Your resolver already sees each domain a user asks for. The question is what kind of site that domain is, and how risky it and the IP behind it are, before it answers. License our category and threat data, keep a local copy, and look up the rest.
Protective DNS threat intelligence is content categories for domains, URLs and millions of IPs, plus risk scores for domains, URLs and IPs, that DNS security and filtering services check against each request. alphaMountain licenses it as URL Classification (92 content categories), Threat Feed (a 1.0 to 10.0 risk score) and Domain/IP reputation factors. Available as OEM, white label or co-branded. See how OEM licensing works.
Turn categories into filtering policy.
Categories let each customer choose what their network allows. Each requested domain gets one of 92 content categories, such as malicious, phishing, adult content, dynamic DNS or newly registered. Block, redirect or allow a domain by its category, or log the request and move on. With Category Feed, you receive only the categories you choose, such as phishing. You can also flag or annotate records in your resolver cache with a category or score, so later queries for the same name can use it.
Add a risk score to the domain and its IP.
Each request gives you three things to check:
- The requested domain: its category, plus a risk score.
- The resolved IP: a risk score, plus a content category for a subset of IPs.
- Reputation factors: registration records, popularity and DNS history, so you can show a customer why a domain was blocked.
A score of 1.0 is very safe and 10.0 is known malicious. Scores from 7.0 to 8.49 are suspicious, so warn or block based on your risk appetite. Scores of 8.5 and up are malicious, and we recommend blocking them.
Check the domains a blocklist has not seen.
A blocklist of known bad domains is only a baseline, because attackers register new domains all the time. The Newly Registered category marks fresh registrations, and the risk score tells you how dangerous a domain looks. Anything missing from your local database (DB) copy goes to the Query API, which returns what your subscription covers, a category or a risk score. The Intelligence API can use it too.
Keep lookups on your own systems.
Run your local DB copy as a database that your own systems query. The Batch API sends batch updates to your local DB copy every hour, delivered as Category Batch or Threat Batch. Everyday lookups stay off our cloud infrastructure, so stability, response time and caching are yours to control.
Count domains, not users.
Each user sends many DNS queries a day. You decide how long to cache results, so count the distinct domains your resolvers see.
- Up to about 100,000 lookups a day: the Query API alone fits.
- Above that: we recommend batch. The Query API handles up to 300,000 a day, but your local DB copy keeps response time under your control.
License it to match how you sell DNS.
Licensing runs on royalty or consumption. License the category and threat databases separately, or as a bundle.
Test it on your own resolvers first.
Ask for a free trial, and we'll support your proof of value. To check a domain right now, search it in threatYeti. If a verdict looks wrong, site owners can report a false positive. We score domains, URLs and IPs, not files.
FAQ
Should we filter by category or by risk score?
Use both. A category says what kind of site a domain is, and a risk score says how dangerous it is. Your policy can act on either one.
Can we score the IP a domain resolves to?
Yes. Risk scores cover domains, URLs and IPs. Content categories cover domains and URLs, plus a subset of IPs.
What if a domain isn't in our local DB copy?
Look it up with the Query API. It returns what your subscription covers, a category or a risk score. The API page lists the fields in each database.
How often does our local DB copy update?
Every hour, through batch updates. The database behind the Query API updates every hour too.
Bring your query volume.
Tell us how many DNS queries you resolve and how many distinct domains that covers. We'll match the products, delivery and licensing to it.