DomainTools Feed | Marketplace

Details
Content
Dependencies
Version History

Indicators feed from DomainTools

The DomainTools Feed provides real-time access to newly registered and observed domains, enabling proactive threat detection and defense.

What does this pack do?

Ingests domain and IP indicators from DomainTools threat feeds (including IP Hotlist and IP Risk).
Enriches indicators with geolocation, ASN, organization, passive DNS resolution counts, and threat-score fields.
Provides a dedicated indicator type and layout for IP indicators sourced from DomainTools feeds.

The DomainTools Feed provides real-time access to newly registered and observed domains, enabling proactive threat detection and defense.

What does this pack do?

Ingests domain and IP indicators from DomainTools threat feeds (including IP Hotlist and IP Risk).
Enriches indicators with geolocation, ASN, organization, passive DNS resolution counts, and threat-score fields.
Provides a dedicated indicator type and layout for IP indicators sourced from DomainTools feeds.

Indicator Fields

Name	Description
DomainToolsFeed IP Bad PDNS Resolutions	Number of confirmed bad domains seen on the IP in the last 24 hours.
DomainToolsFeed IP Predicted Malware	Number of domains (with no confirmed threat) predicted as malware hosted on the IP.
DomainToolsFeed IP City	City derived from geolocation data for the IP address.
DomainToolsFeed IP Organization	Organization associated with the IP address range based on geolocation data.
DomainToolsFeed IP Malicious Malware	Number of confirmed malware domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP All Threats Combined Count	Number of confirmed or predicted malicious domains hosted on the IP.
DomainToolsFeed IP Combined Malware Percent	Percentage of total domains on the IP that are confirmed or predicted as malware.
DomainToolsFeed IP Compromised Phishing	Number of compromised phishing domains hosted on the IP.
DomainToolsFeed IP Country	Country derived from geolocation data for the IP address.
DomainToolsFeed IP Percent Spam	Percentage of total domains on the IP that are confirmed spam.
DomainToolsFeed IP Malicious Phishing	Number of confirmed phishing domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Feed Timestamp	ISO 8601 UTC timestamp when the IP risk assessment was last updated.
DomainToolsFeed IP Percent Phishing	Percentage of total domains on the IP that are confirmed phishing.
DomainToolsFeed IP Percent Malware	Percentage of total domains on the IP that are confirmed malware.
DomainToolsFeed IP Compromised Spam	Number of compromised spam domains hosted on the IP.
DomainToolsFeed IP Combined Spam Percent	Percentage of total domains on the IP that are confirmed or predicted as spam.
DomainToolsFeed IP Zerolist IP	Indicates whether the IP is zero-listed (e.g., a CDN or other shared infrastructure).
DomainToolsFeed IP Predicted Phishing	Number of domains (with no confirmed threat) predicted as phishing hosted on the IP.
DomainToolsFeed IP All Threats Percent	Percentage of total domains on the IP including all threat types.
DomainToolsFeed IP Third Party Threats	Number of domains on the IP confirmed with any threat on a third-party intel feed.
DomainToolsFeed IP Zerolist Domains	Number of zero-listed domains seen on the IP (e.g., from CDNs or shared infrastructure).
DomainToolsFeed IP Total Domains	Total number of domains seen on the IP in the last 7 days.
DomainToolsFeed IP Combined Phishing Percent	Percentage of total domains on the IP that are confirmed or predicted as phishing.
DomainToolsFeed IP Longitude	Geographic longitude coordinate of the IP address.
DomainToolsFeed IP All Threats Combined Percent	Percentage of total domains on the IP that are confirmed or predicted malicious.
DomainToolsFeed IP Compromised Malware	Number of compromised malware domains hosted on the IP.
DomainToolsFeed IP PDNS Resolutions	Number of domains seen on the IP in the last 24 hours.
DomainToolsFeed IP ASN	The IP's ASN (autonomous system number, routing provider).
DomainToolsFeed IP Malicious Spam	Number of confirmed spam domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Predicted Spam	Number of domains (with no confirmed threat) predicted as spam hosted on the IP.
DomainToolsFeed IP Latitude	Geographic latitude coordinate of the IP address.

Integrations

Name	Description
FeedDomainTools (Partner Contribution)	Real-Time Threat Intelligence Feeds provide data on the different stages of the domain lifecycle: from first-observed in the wild, to newly re-activated after a period of quiet. Newly Active Domains surfaces apex-level domains seen for the first time or after ten or more days of inactivity. Newly Observed Domains surfaces domains that we observe for the first time. Also includes IP Hotlist and IP Risk feeds for identifying malicious IP addresses based on passive DNS resolutions, threat percentages, and geographic filters.

Name

Description

FeedDomainTools (Partner Contribution)

Real-Time Threat Intelligence Feeds provide data on the different stages of the domain lifecycle: from first-observed in the wild, to newly re-activated after a period of quiet. Newly Active Domains surfaces apex-level domains seen for the first time or after ten or more days of inactivity. Newly Observed Domains surfaces domains that we observe for the first time. Also includes IP Hotlist and IP Risk feeds for identifying malicious IP addresses based on passive DNS resolutions, threat percentages, and geographic filters.

Layouts

Name	Description
DomainToolsFeed IP Indicator	DomainToolsFeed IP Indicator Layout

Indicator Types

Name	Description
DomainToolsFeed IP

Indicator Fields

Name	Description
DomainToolsFeed IP All Threats Combined Percent	Percentage of total domains on the IP that are confirmed or predicted malicious.
DomainToolsFeed IP Zerolist Domains	Number of zero-listed domains seen on the IP (e.g., from CDNs or shared infrastructure).
DomainToolsFeed IP Country	Country derived from geolocation data for the IP address.
DomainToolsFeed IP Combined Malware Percent	Percentage of total domains on the IP that are confirmed or predicted as malware.
DomainToolsFeed IP Latitude	Geographic latitude coordinate of the IP address.
DomainToolsFeed IP Organization	Organization associated with the IP address range based on geolocation data.
DomainToolsFeed IP Longitude	Geographic longitude coordinate of the IP address.
DomainToolsFeed IP Predicted Phishing	Number of domains (with no confirmed threat) predicted as phishing hosted on the IP.
DomainToolsFeed IP ASN	The IP's ASN (autonomous system number, routing provider).
DomainToolsFeed IP Compromised Phishing	Number of compromised phishing domains hosted on the IP.
DomainToolsFeed IP Predicted Malware	Number of domains (with no confirmed threat) predicted as malware hosted on the IP.
DomainToolsFeed IP Third Party Threats	Number of domains on the IP confirmed with any threat on a third-party intel feed.
DomainToolsFeed IP PDNS Resolutions	Number of domains seen on the IP in the last 24 hours.
DomainToolsFeed IP Bad PDNS Resolutions	Number of confirmed bad domains seen on the IP in the last 24 hours.
DomainToolsFeed IP Feed Timestamp	ISO 8601 UTC timestamp when the IP risk assessment was last updated.
DomainToolsFeed IP Malicious Phishing	Number of confirmed phishing domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Percent Malware	Percentage of total domains on the IP that are confirmed malware.
DomainToolsFeed IP Total Domains	Total number of domains seen on the IP in the last 7 days.
DomainToolsFeed IP All Threats Combined Count	Number of confirmed or predicted malicious domains hosted on the IP.
DomainToolsFeed IP Malicious Malware	Number of confirmed malware domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Combined Spam Percent	Percentage of total domains on the IP that are confirmed or predicted as spam.
DomainToolsFeed IP City	City derived from geolocation data for the IP address.
DomainToolsFeed IP All Threats Percent	Percentage of total domains on the IP including all threat types.
DomainToolsFeed IP Percent Phishing	Percentage of total domains on the IP that are confirmed phishing.
DomainToolsFeed IP Combined Phishing Percent	Percentage of total domains on the IP that are confirmed or predicted as phishing.
DomainToolsFeed IP Compromised Malware	Number of compromised malware domains hosted on the IP.
DomainToolsFeed IP Zerolist IP	Indicates whether the IP is zero-listed (e.g., a CDN or other shared infrastructure).
DomainToolsFeed IP Predicted Spam	Number of domains (with no confirmed threat) predicted as spam hosted on the IP.
DomainToolsFeed IP Compromised Spam	Number of compromised spam domains hosted on the IP.
DomainToolsFeed IP Malicious Spam	Number of confirmed spam domains on third-party intel feeds hosted on the IP.
DomainToolsFeed IP Percent Spam	Percentage of total domains on the IP that are confirmed spam.

Integrations

Name	Description
FeedDomainTools (Partner Contribution)	Real-Time Threat Intelligence Feeds provide data on the different stages of the domain lifecycle: from first-observed in the wild, to newly re-activated after a period of quiet. Newly Active Domains surfaces apex-level domains seen for the first time or after ten or more days of inactivity. Newly Observed Domains surfaces domains that we observe for the first time. Also includes IP Hotlist and IP Risk feeds for identifying malicious IP addresses based on passive DNS resolutions, threat percentages, and geographic filters.

Name

Description

FeedDomainTools (Partner Contribution)

Layouts

Name	Description
DomainToolsFeed IP Indicator	DomainToolsFeed IP Indicator Layout

Indicator Types

Name	Description
DomainToolsFeed IP

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

1.2.0 - 13242712 (September 23, 2026)

Indicator Fields

DomainToolsFeed IP ASN

Added a new indicator field: DomainToolsFeed IP ASN, which stores the autonomous system number (routing provider) associated with the IP address.

DomainToolsFeed IP All Threats Combined Count

Added a new indicator field: DomainToolsFeed IP All Threats Combined Count, which stores the count of confirmed or predicted malicious domains hosted on the IP.

DomainToolsFeed IP All Threats Combined Percent

Added a new indicator field: DomainToolsFeed IP All Threats Combined Percent, which stores the percentage of total domains on the IP that are confirmed or predicted malicious.

DomainToolsFeed IP All Threats Percent

Added a new indicator field: DomainToolsFeed IP All Threats Percent, which stores the percentage of domains on the IP including all threat types.

DomainToolsFeed IP Bad PDNS Resolutions

Added a new indicator field: DomainToolsFeed IP Bad PDNS Resolutions, which stores the count of confirmed bad domains seen on the IP in the last 24 hours.

DomainToolsFeed IP City

Added a new indicator field: DomainToolsFeed IP City, which stores the city derived from geolocation data for the IP address.

DomainToolsFeed IP Combined Malware Percent

Added a new indicator field: DomainToolsFeed IP Combined Malware Percent, which stores the percentage of domains on the IP that are confirmed or predicted as malware.

DomainToolsFeed IP Combined Phishing Percent

Added a new indicator field: DomainToolsFeed IP Combined Phishing Percent, which stores the percentage of domains on the IP that are confirmed or predicted as phishing.

DomainToolsFeed IP Combined Spam Percent

Added a new indicator field: DomainToolsFeed IP Combined Spam Percent, which stores the percentage of domains on the IP that are confirmed or predicted as spam.

DomainToolsFeed IP Compromised Malware

Added a new indicator field: DomainToolsFeed IP Compromised Malware, which stores the count of compromised malware domains hosted on the IP.

DomainToolsFeed IP Compromised Phishing

Added a new indicator field: DomainToolsFeed IP Compromised Phishing, which stores the count of compromised phishing domains hosted on the IP.

DomainToolsFeed IP Compromised Spam

Added a new indicator field: DomainToolsFeed IP Compromised Spam, which stores the count of compromised spam domains hosted on the IP.

DomainToolsFeed IP Country

Added a new indicator field: DomainToolsFeed IP Country, which stores the country derived from geolocation data for the IP address.

DomainToolsFeed IP Feed Timestamp

Added a new indicator field: DomainToolsFeed IP Feed Timestamp, which stores the timestamp of when the IP was observed in the DomainTools threat feed.

DomainToolsFeed IP Latitude

Added a new indicator field: DomainToolsFeed IP Latitude, which stores the geographic latitude coordinate of the IP address.

DomainToolsFeed IP Longitude

Added a new indicator field: DomainToolsFeed IP Longitude, which stores the geographic longitude coordinate of the IP address.

DomainToolsFeed IP Malicious Malware

Added a new indicator field: DomainToolsFeed IP Malicious Malware, which stores the count of confirmed malware domains hosted on the IP.

DomainToolsFeed IP Malicious Phishing

Added a new indicator field: DomainToolsFeed IP Malicious Phishing, which stores the count of confirmed phishing domains hosted on the IP.

DomainToolsFeed IP Malicious Spam

Added a new indicator field: DomainToolsFeed IP Malicious Spam, which stores the count of confirmed spam domains hosted on the IP.

DomainToolsFeed IP Organization

Added a new indicator field: DomainToolsFeed IP Organization, which stores the organization associated with the IP address range.

DomainToolsFeed IP PDNS Resolutions

Added a new indicator field: DomainToolsFeed IP PDNS Resolutions, which stores the count of domains seen on the IP in the last 24 hours.

DomainToolsFeed IP Percent Malware

Added a new indicator field: DomainToolsFeed IP Percent Malware, which stores the percentage of confirmed malware domains hosted on the IP.

DomainToolsFeed IP Percent Phishing

Added a new indicator field: DomainToolsFeed IP Percent Phishing, which stores the percentage of confirmed phishing domains hosted on the IP.

DomainToolsFeed IP Percent Spam

Added a new indicator field: DomainToolsFeed IP Percent Spam, which stores the percentage of confirmed spam domains hosted on the IP.

DomainToolsFeed IP Predicted Malware

Added a new indicator field: DomainToolsFeed IP Predicted Malware, which stores the count of predicted malware domains hosted on the IP.

DomainToolsFeed IP Predicted Phishing

Added a new indicator field: DomainToolsFeed IP Predicted Phishing, which stores the count of predicted phishing domains hosted on the IP.

DomainToolsFeed IP Predicted Spam

Added a new indicator field: DomainToolsFeed IP Predicted Spam, which stores the count of predicted spam domains hosted on the IP.

DomainToolsFeed IP Third Party Threats

Added a new indicator field: DomainToolsFeed IP Third Party Threats, which stores the count of domains on the IP with confirmed threats on third-party feeds.

DomainToolsFeed IP Total Domains

Added a new indicator field: DomainToolsFeed IP Total Domains, which stores the total count of domains hosted on the IP in the last 7 days.

DomainToolsFeed IP Zerolist Domains

Added a new indicator field: DomainToolsFeed IP Zerolist Domains, which stores the count of zero-listed domains hosted on the IP.

DomainToolsFeed IP Zerolist IP

Added a new indicator field: DomainToolsFeed IP Zerolist IP, which indicates whether the IP is zero-listed (e.g., a CDN or shared infrastructure).

Indicator Types

DomainToolsFeed IP
Added a new indicator type: DomainToolsFeed IP, which represents IP addresses identified as malicious by the DomainTools IP Hotlist and IP Risk threat feeds.

Integrations

FeedDomainTools

Added the iphotlist and iprisk options to the Feed Type parameter. Instances configured with Feed Type set to ALL will begin ingesting IP indicators after upgrading.
Added support for percent_spam_min argument in the domaintools-get-indicators command.
Added support for organization argument in the domaintools-get-indicators command.
Added support for asn argument in the domaintools-get-indicators command.
Added support for combined_phishing_percent_min argument in the domaintools-get-indicators command.
Added support for pdns_resolutions_min argument in the domaintools-get-indicators command.
Added support for all_threats_percent_min argument in the domaintools-get-indicators command.
Added support for combined_spam_percent_min argument in the domaintools-get-indicators command.
Added support for third_party_threats_min argument in the domaintools-get-indicators command.
Added support for percent_phishing_min argument in the domaintools-get-indicators command.
Added support for total_domains_max argument in the domaintools-get-indicators command.
Added support for combined_malware_percent_min argument in the domaintools-get-indicators command.
Added support for all_threats_combined_percent_min argument in the domaintools-get-indicators command.
Added support for percent_malware_min argument in the domaintools-get-indicators command.
Added support for bad_pdns_resolutions_min argument in the domaintools-get-indicators command.
Added support for country_code argument in the domaintools-get-indicators command.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.13176850.

Layouts

DomainToolsFeed IP Indicator
Added a new layout: DomainToolsFeed IP Indicator, which displays all IP threat data fields.

Related pull requests:
- 45754
- 45977

Download

1.1.1 - 13134964 (September 17, 2026)

Integrations

FeedDomainTools

Updated the Docker image to: demisto/vendors-sdk:1.0.0.11778894.

Related pull requests:
- 45904

Download

1.1.0 - 11786168 (August 9, 2026)

Integrations

FeedDomainTools

Updated the FeedDomainTools integration to use the DomainTools Python Wrapper for feed endpoints.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.10470199.

Related pull requests:
- 45083
- 45345

Download

1.0.8 - 10828903 (July 7, 2026)

Integrations

FeedDomainTools

Updated the Docker image to: demisto/vendors-sdk:1.0.0.10120494.

Related pull requests:
- 44905

Download

1.0.7 - 8888333 (May 10, 2026)

Integrations

FeedDomainTools

Fixed an issue for domainrisk and domainhotlist feeds where the risk score details are not in rawJSON.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.8307504.

Related pull requests:
- 44140
- 44090

Download

1.0.6 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

1.0.5 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.0.4 - 5620515 (October 28, 2025)

Integrations

FeedDomainTools

Added the domainrisk domaintools feed.
Added the domainhotlist domaintools feed.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.4821574.

Related pull requests:
- 41491
- 41680

Download

1.0.3 - R5469292 (October 20, 2025)

Integrations

FeedDomainTools

Added the noh (newly-observed-hostnames) domaintools feed.

Related pull requests:
- 39763
- 39780

Download

1.2.0 - 13242712 (September 23, 2026)

Indicator Fields

DomainToolsFeed IP ASN

Added a new indicator field: DomainToolsFeed IP ASN, which stores the autonomous system number (routing provider) associated with the IP address.

DomainToolsFeed IP All Threats Combined Count

Added a new indicator field: DomainToolsFeed IP All Threats Combined Count, which stores the count of confirmed or predicted malicious domains hosted on the IP.

DomainToolsFeed IP All Threats Combined Percent

Added a new indicator field: DomainToolsFeed IP All Threats Combined Percent, which stores the percentage of total domains on the IP that are confirmed or predicted malicious.

DomainToolsFeed IP All Threats Percent

Added a new indicator field: DomainToolsFeed IP All Threats Percent, which stores the percentage of domains on the IP including all threat types.

DomainToolsFeed IP Bad PDNS Resolutions

Added a new indicator field: DomainToolsFeed IP Bad PDNS Resolutions, which stores the count of confirmed bad domains seen on the IP in the last 24 hours.

DomainToolsFeed IP City

Added a new indicator field: DomainToolsFeed IP City, which stores the city derived from geolocation data for the IP address.

DomainToolsFeed IP Combined Malware Percent

Added a new indicator field: DomainToolsFeed IP Combined Malware Percent, which stores the percentage of domains on the IP that are confirmed or predicted as malware.

DomainToolsFeed IP Combined Phishing Percent

Added a new indicator field: DomainToolsFeed IP Combined Phishing Percent, which stores the percentage of domains on the IP that are confirmed or predicted as phishing.

DomainToolsFeed IP Combined Spam Percent

Added a new indicator field: DomainToolsFeed IP Combined Spam Percent, which stores the percentage of domains on the IP that are confirmed or predicted as spam.

DomainToolsFeed IP Compromised Malware

Added a new indicator field: DomainToolsFeed IP Compromised Malware, which stores the count of compromised malware domains hosted on the IP.

DomainToolsFeed IP Compromised Phishing

Added a new indicator field: DomainToolsFeed IP Compromised Phishing, which stores the count of compromised phishing domains hosted on the IP.

DomainToolsFeed IP Compromised Spam

Added a new indicator field: DomainToolsFeed IP Compromised Spam, which stores the count of compromised spam domains hosted on the IP.

DomainToolsFeed IP Country

Added a new indicator field: DomainToolsFeed IP Country, which stores the country derived from geolocation data for the IP address.

DomainToolsFeed IP Feed Timestamp

Added a new indicator field: DomainToolsFeed IP Feed Timestamp, which stores the timestamp of when the IP was observed in the DomainTools threat feed.

DomainToolsFeed IP Latitude

Added a new indicator field: DomainToolsFeed IP Latitude, which stores the geographic latitude coordinate of the IP address.

DomainToolsFeed IP Longitude

Added a new indicator field: DomainToolsFeed IP Longitude, which stores the geographic longitude coordinate of the IP address.

DomainToolsFeed IP Malicious Malware

Added a new indicator field: DomainToolsFeed IP Malicious Malware, which stores the count of confirmed malware domains hosted on the IP.

DomainToolsFeed IP Malicious Phishing

Added a new indicator field: DomainToolsFeed IP Malicious Phishing, which stores the count of confirmed phishing domains hosted on the IP.

DomainToolsFeed IP Malicious Spam

Added a new indicator field: DomainToolsFeed IP Malicious Spam, which stores the count of confirmed spam domains hosted on the IP.

DomainToolsFeed IP Organization

Added a new indicator field: DomainToolsFeed IP Organization, which stores the organization associated with the IP address range.

DomainToolsFeed IP PDNS Resolutions

Added a new indicator field: DomainToolsFeed IP PDNS Resolutions, which stores the count of domains seen on the IP in the last 24 hours.

DomainToolsFeed IP Percent Malware

Added a new indicator field: DomainToolsFeed IP Percent Malware, which stores the percentage of confirmed malware domains hosted on the IP.

DomainToolsFeed IP Percent Phishing

Added a new indicator field: DomainToolsFeed IP Percent Phishing, which stores the percentage of confirmed phishing domains hosted on the IP.

DomainToolsFeed IP Percent Spam

Added a new indicator field: DomainToolsFeed IP Percent Spam, which stores the percentage of confirmed spam domains hosted on the IP.

DomainToolsFeed IP Predicted Malware

Added a new indicator field: DomainToolsFeed IP Predicted Malware, which stores the count of predicted malware domains hosted on the IP.

DomainToolsFeed IP Predicted Phishing

Added a new indicator field: DomainToolsFeed IP Predicted Phishing, which stores the count of predicted phishing domains hosted on the IP.

DomainToolsFeed IP Predicted Spam

Added a new indicator field: DomainToolsFeed IP Predicted Spam, which stores the count of predicted spam domains hosted on the IP.

DomainToolsFeed IP Third Party Threats

Added a new indicator field: DomainToolsFeed IP Third Party Threats, which stores the count of domains on the IP with confirmed threats on third-party feeds.

DomainToolsFeed IP Total Domains

Added a new indicator field: DomainToolsFeed IP Total Domains, which stores the total count of domains hosted on the IP in the last 7 days.

DomainToolsFeed IP Zerolist Domains

Added a new indicator field: DomainToolsFeed IP Zerolist Domains, which stores the count of zero-listed domains hosted on the IP.

DomainToolsFeed IP Zerolist IP

Added a new indicator field: DomainToolsFeed IP Zerolist IP, which indicates whether the IP is zero-listed (e.g., a CDN or shared infrastructure).

Indicator Types

DomainToolsFeed IP
Added a new indicator type: DomainToolsFeed IP, which represents IP addresses identified as malicious by the DomainTools IP Hotlist and IP Risk threat feeds.

Integrations

FeedDomainTools

Added the iphotlist and iprisk options to the Feed Type parameter. Instances configured with Feed Type set to ALL will begin ingesting IP indicators after upgrading.
Added support for percent_spam_min argument in the domaintools-get-indicators command.
Added support for organization argument in the domaintools-get-indicators command.
Added support for asn argument in the domaintools-get-indicators command.
Added support for combined_phishing_percent_min argument in the domaintools-get-indicators command.
Added support for pdns_resolutions_min argument in the domaintools-get-indicators command.
Added support for all_threats_percent_min argument in the domaintools-get-indicators command.
Added support for combined_spam_percent_min argument in the domaintools-get-indicators command.
Added support for third_party_threats_min argument in the domaintools-get-indicators command.
Added support for percent_phishing_min argument in the domaintools-get-indicators command.
Added support for total_domains_max argument in the domaintools-get-indicators command.
Added support for combined_malware_percent_min argument in the domaintools-get-indicators command.
Added support for all_threats_combined_percent_min argument in the domaintools-get-indicators command.
Added support for percent_malware_min argument in the domaintools-get-indicators command.
Added support for bad_pdns_resolutions_min argument in the domaintools-get-indicators command.
Added support for country_code argument in the domaintools-get-indicators command.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.13176850.

Layouts

DomainToolsFeed IP Indicator
Added a new layout: DomainToolsFeed IP Indicator, which displays all IP threat data fields.

Related pull requests:
- 45754
- 45977

Download

1.1.1 - 13134964 (September 17, 2026)

Integrations

FeedDomainTools

Updated the Docker image to: demisto/vendors-sdk:1.0.0.11778894.

Related pull requests:
- 45904

Download

1.1.0 - 11786168 (August 9, 2026)

Integrations

FeedDomainTools

Updated the FeedDomainTools integration to use the DomainTools Python Wrapper for feed endpoints.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.10470199.

Related pull requests:
- 45083
- 45345

Download

1.0.8 - 10828903 (July 7, 2026)

Integrations

FeedDomainTools

Updated the Docker image to: demisto/vendors-sdk:1.0.0.10120494.

Related pull requests:
- 44905

Download

1.0.7 - 8888333 (May 10, 2026)

Integrations

FeedDomainTools

Fixed an issue for domainrisk and domainhotlist feeds where the risk score details are not in rawJSON.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.8307504.

Related pull requests:
- 44140
- 44090

Download

1.0.6 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

1.0.5 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.0.4 - 5620515 (October 28, 2025)

Integrations

FeedDomainTools

Added the domainrisk domaintools feed.
Added the domainhotlist domaintools feed.
Updated the Docker image to: demisto/vendors-sdk:1.0.0.4821574.

Related pull requests:
- 41491
- 41680

Download

1.0.3 - R5469292 (October 20, 2025)

Integrations

FeedDomainTools

Added the noh (newly-observed-hostnames) domaintools feed.

Related pull requests:
- 39763
- 39780

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	March 12, 2025
Last Release	September 23, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.