The economics of a managed security practice punish anything priced per seat or per endpoint, because you carry the cost across every client whether or not they value it. A daily list of 390,000-plus DNS-verified phishing domains is not priced that way: you take one copy, and it enriches tier-1 triage, feeds SOAR playbooks, and populates blocklists in as many tenants as you operate. This page is about the operational shape of that, and about the difference between reselling somebody's verdicts and embedding a list you hold.
A managed practice does not buy tools the way an enterprise does, because the cost lands across a book of clients with wildly different sizes and wildly different willingness to pay.
The commercial shape of a managed security business is unforgiving in a way that in-house teams rarely appreciate. You have a book of clients ranging from a thirty-person accountancy practice to a several-thousand-seat manufacturer. You have a service description that promises the same detection capability to all of them, because tiering the actual security content is both operationally miserable and hard to defend in a sales conversation. And you have a gross margin that gets squeezed every time a data source prices itself per endpoint, per user or per tenant, because the small clients cannot absorb their share and you end up eating it.
Sources priced per seat get bought for the top of the book and quietly withheld from the bottom, creating a two-tier service you then have to describe carefully. Sources priced per query get bought and then rationed, with analysts told to check "only when it matters" — which is precisely the instruction guaranteeing the check does not happen during a busy shift. Neither is what anybody intended when the tool was evaluated.
You pay once for the right to download the database, and the file is the same file whether it protects four tenants or four hundred. There is no per-tenant licence to track, no seat count to reconcile at renewal, and no moment where onboarding a client triggers a cost increase you have to price into the deal. Downloads are unlimited, so there is no meter running.
Controls that are metered get used less than controls that are not, regardless of what the policy says, because analysts internalise cost signals. A source costing nothing at the margin gets wired into the default path — the enrichment step that runs on every alert rather than on the ones somebody judged worthy. That is the version that changes your false-positive rate, and it is only available when the pricing model permits it.
None of these requires a new console, a new agent, or anything a client has to see. They are all things you do with a file you already hold.
A proxy or DNS alert naming a domain arrives with no context. A local lookup against the list attaches a definite verdict before a human sees the ticket, which turns "investigate this domain" into either a confirmed true positive with an escalation path or a low-priority item that can be closed on a rule.
The enrichment step is a local match rather than an external call, so it adds no latency budget, no API failure mode and no rate limit to your playbook. Where a playbook must call out, /check answers in under 50 milliseconds within a 10-per-second-per-key limit.
The same file drops into each tenant's enforcement point — a DNS response policy zone, a firewall address list, a secure web gateway custom category, or a mail gateway URL blocklist. One retrieval, many destinations, and a distribution job you probably already own for other content.
The daily changelog names what was added. Run today's additions against yesterday's DNS, proxy and mail logs per tenant and you find the users who reached a host before it was known — which is a credential-reset conversation, not a blocked-request statistic.
Blocked-connection counts per tenant, retrospective findings, and month-on-month movement are all derivable from data you already hold, without asking the client to install anything or believe a vendor-supplied benchmark.
The unglamorous one. An analyst has a domain from a forwarded email and wants an answer now. A local grep against the current file is instant and leaves no trace outside your infrastructure — which matters when the domain came from a client's incident.
This is a known-bad lookup: a match means the hostname has a confirmed active A record and has been verified as phishing or malware infrastructure as of its last_checked date, while a clean result means the hostname is not on the list rather than that it is safe, and a domain registered and first used inside the same hour will not be present yet. Write that into the service description rather than leaving it implicit, because a client told the boundary in advance treats a miss as a known limitation of one layer while a client who inferred completeness from a sales deck treats the same miss as a failure of the service — see the threat intelligence page for how this is framed more generally.
The value of a definite answer is not the answer. It is the twenty minutes of investigation that no longer has to happen, multiplied by the volume of a multi-tenant queue.
Consider what a tier-1 analyst actually does with a domain-bearing alert in the absence of a good source. They open a reputation service and get a score with no stated methodology. They check registration age, which tells them something but not enough. They look at what else resolves to the same address. They may or may not visit the page through an isolated browser, depending on whether your policy permits it and whether the sandbox is working today. Somewhere between five and twenty-five minutes later they form a judgement that is, honestly, a guess with supporting evidence — and they write it into the ticket in language that suggests more certainty than they have.
Multiply that investigation by the alert volume of a whole book and the cost is enormous, but the bigger problem is that two analysts working the same domain reach different conclusions — and the difference is not competence, it is which of the eight browser tabs they happened to weight. That variance is what a client experiences as inconsistency in your service, and it is what makes quality review across a shift roster so laborious.
Where the domain is on the list, the analyst has unambiguous confirmation with a stated inclusion test — an active A record verified through rotating proxy infrastructure on a host assessed as phishing or malware distribution — plus a last_checked date. The ticket becomes an escalation immediately, with the same wording every time. Confidence is 0.98 or 0.0 with nothing between, because a graduated score reintroduces exactly the discretion the enrichment was meant to remove.
The correct runbook instruction is that the check returned no match and the normal investigation continues — not that the domain is clean. Runbooks folding an absence of information into a disposition are how a good enrichment source becomes a source of false negatives, and it is the most common way this kind of integration gets misused. Write the rules so a match can close a question and a non-match cannot.
You are not reducing the number of alerts your sensors generate, and claiming that in a QBR deck will not survive scrutiny. You are reducing the time each domain-bearing alert consumes, and removing a category of ticket that would otherwise have been escalated to tier 2 on the strength of a nervous analyst's judgement. Measure the second thing, because it is real and it is defensible.
Two purchasing shapes, and the arithmetic that decides which one a managed practice should be on.
Plans are monthly subscriptions via PayPal, priced by volume: Growth at $99/month for 25,000 lookups, Professional at $249/month for 100,000 lookups with priority support, Business at $499/month for 250,000 lookups with dedicated support, and Enterprise at $999/month for 750,000 lookups with an account manager. Unused lookups reset at the end of each billing month.
Billed monthly, cancel any time. Includes priority support, daily-updated data and unlimited downloads.
Not the headline price but the shape: the feed handles steady-state matching across every tenant at zero marginal cost, and the bundled credits cover the interactive and playbook lookups that genuinely have to hit the API.
The limit matters more at analyst scale than the price does, because it is shared across every playbook and every tenant using that key. One noisy tenant can starve everything else.
/batch takes 100 domains per POST at one lookup each, returning checked, phishing_found and credits_used. A single key sustains roughly 1,000 domain checks per second batched, and roughly 10 unbatched — produced entirely by how the integration is written.
A busy tenant generates the same handful of domains repeatedly within a minute. Cache verdicts for the length of a build cycle, since the data changes once every 24 hours at 04:30 UTC and re-asking inside that window buys nothing at all.
/stats reports database size and last update with no API key, no credits and no authentication — a sensible target for a monitoring check that must run outside any credentialled path, including one that verifies your own copy is not stale.
Written for a practice that already has a content distribution pipeline. If you do not, step three is the one that becomes a project.
Pull the domains from ninety days of escalated alerts across the book and batch them. The hit rate on incidents you already investigated is the only evaluation number worth showing a service director.
A scheduled pull shortly after 04:30 UTC, a validity check on the file before it replaces the live copy, and one alert if the current file is older than forty-eight hours. Staleness is the failure mode.
Push the file through whatever already distributes content to client estates — your RMM, configuration management, or per-tenant firewall automation. Track which tenants confirmed the load, not just which were sent it.
Add the local match to the tier-1 runbook and the SOAR playbook, with disposition rules that let a match close a question and never let a non-match do the same. Batch and deduplicate anything that calls out.
Attribute blocks and retrospective findings to the tenant they belong to from day one. Reconstructing per-client figures later, from logs that were never tagged, is far more painful than tagging them now.
Both are legitimate. They carry different obligations, different failure modes and different conversations with a client's procurement team.
You call the API per event and surface the answer to the client, in your portal or in a ticket. It is quick to build, honest about provenance if you name the source, and it scales linearly with event volume — which means your cost and your rate-limit headroom both track your busiest tenant's worst day. It also creates a dependency the client can feel: if the service is unreachable during an incident, the enrichment your runbook assumes is simply absent, and the analyst is back to eight browser tabs.
You hold the database and match locally in your own platform. Matching costs nothing per event, survives any upstream outage, adds no latency to a playbook, and never transmits a client's domains anywhere, so onboarding a tenant is a distribution step rather than a commercial event. The trade is that you now own freshness: your copy is exactly as current as your last successful retrieval, which is why the staleness alert in step two is the most important line of the whole deployment.
Presenting the capability under your own brand is normal in this industry and there is nothing improper about it. The API is called from your backend, or the list is matched inside your platform, and the client sees a verdict in your portal. What deserves thought is the language around it, because a managed provider's credibility is built on clients believing the descriptions in the service catalogue.
The factual ones about the data: a daily-rebuilt list of domains verified as actively resolving credential-harvesting and malware infrastructure, matched against every monitored event, with per-tenant reporting. Those are true, checkable and specific enough to differentiate you from a competitor whose marketing says "advanced threat intelligence" and stops there.
Implied exhaustiveness — language suggesting that phishing domains are blocked, rather than that known phishing domains are blocked. The gap between those two sentences is where every awkward post-incident conversation lives, and it is a gap you create for yourself in a sales deck long before anybody has to stand in it.
Work out in advance how you answer a client who asks where the data comes from. Refusing to say invites the assumption that you built it yourself, which is a claim you then have to sustain under scrutiny. Naming the source costs very little, because the client is buying your operations, integration and analysts rather than a data licence they could buy directly and would have no idea what to do with.
If you tagged correctly at step five: blocked connections to verified phishing infrastructure this quarter split by tenant, retrospective findings from the daily changelog, movement over time, and new tenants brought onto the same list at onboarding with no additional cost. All of it derived from data you already hold, with nothing for the client to install.
A client cannot verify a benchmark and can verify their own numbers, so a chart drawn from their own logs is worth more than any figure about their sector. It also removes the awkward moment where somebody asks where the comparison came from and the honest answer is a vendor's marketing page.
A QBR reporting "we found two users who reached a host before it was on the list, reset their credentials, and here is the timeline" is a far stronger argument for the service than a clean chart, and it is the kind of candour that renews contracts. The same reporting discipline appears on the incident response and SIEM integration pages.
Including the licensing question, which is the one everybody wants answered first and nobody asks first.
The feed is a database download with unlimited retrievals, and it is designed to be loaded into infrastructure you operate — which for a managed provider means the enforcement points across your client estates. There is no per-tenant licence key, no seat count and no activation step per client, so onboarding a new tenant is a distribution task rather than a commercial event. Where it is worth a conversation rather than an assumption is if you intend to redistribute the raw database itself to clients as a data product they hold independently of your service — that is a different arrangement from embedding it in a service you operate, and the enterprise terms, which also cover SFTP and S3 delivery, STIX/TAXII and custom update frequencies, are quoted rather than listed. Ask before you build a product on the assumption.
Yes, if you leave it that way. The limit is 10 requests per second per key, so a per-artefact playbook tops out at 10 domains per second regardless of how many workers you run, and a burst from one noisy tenant will starve every other playbook using the same key. Batching fixes it: the /batch endpoint takes up to 100 domains per POST at one lookup each, which turns the same 10 requests per second into roughly 1,000 domain checks per second, and adding deduplication before submission plus a short-lived cache — the data changes once per 24 hours at 04:30 UTC, so re-asking within a build cycle achieves nothing — makes the limit stop being a consideration. For anything genuinely bulk, match against the local feed copy instead and do not call out at all.
With the per-query endpoints, yes — each call transmits the hostname you asked about. For a lot of enrichment work that is unremarkable, but it is a real question when the domain came out of a client incident, and it is a question that appears on client security questionnaires more often every year. Retrieving the whole database and matching locally removes the question: no client domain is ever transmitted, and the only outbound traffic is your scheduled download. That is a straightforward answer to give in a questionnaire, and it is architecturally true rather than a contractual promise about somebody else's log retention.
Plainly, and early. The wording that works is that the service blocks and flags domains verified as active phishing infrastructure, that verification requires the host to be resolving, and that a domain first used within the same hour it was registered may not yet be present. Then say what covers that gap in your stack — behavioural detection, mail authentication, user reporting, whatever you actually run. A client told this at onboarding treats a miss as a known property of one layer, whereas a client who inferred completeness from a sales deck treats the same miss as a service failure and says so in the renewal meeting — so the cost of the honest sentence is close to zero, and the cost of omitting it is a conversation you cannot win.
Be careful what you measure, because the tempting metric is the wrong one. You are not reducing alert volume — your sensors generate exactly as many alerts as before. What changes is handling time on domain-bearing alerts, and the number of tickets escalated to tier 2 purely because an analyst could not reach a confident conclusion. Measure those two directly, over a defined period, against your own baseline — and measure consistency alongside them, because the same domain producing the same disposition regardless of who is on shift is worth more to a managed practice than any single-ticket time saving, being what makes quality review across a roster possible at all.
Possibly, and the way to find out is empirical rather than architectural. Take ninety days of domains from your own escalated alerts, run them against both, and look at the overlap and the gaps. If your existing platform already carries everything with equivalent freshness and a comparable inclusion standard, you have your answer and it costs you an afternoon. What usually differs is the retention rule rather than the collection: many platforms accumulate indicators indefinitely, which is right for research and wrong for a blocklist because it grows a file your enforcement points parse forever, whereas here a domain that stops resolving falls out, so what you distribute describes hosts that are answering rather than everything ever observed. Whether that difference matters depends entirely on where you are putting the data.
Yes, and it is the normal arrangement. Calls are made from your backend or matching happens inside your platform, and the client sees a verdict in your portal alongside everything else you produce. The discipline that matters is in the language rather than the branding: claim what is true about the data — daily rebuild, verification by active DNS resolution, per-tenant coverage, dated observations — avoid phrasing that implies exhaustiveness, and decide in advance what you say when a client asks where the data comes from, because refusing to answer implies you built it, which is a claim you would then have to sustain under scrutiny.
Nothing visible, which is exactly the danger. Enforcement carries on against your last successful copy, blocks keep happening, dashboards stay green, and the only symptom is that domains added over the last seven days are absent. This is the failure mode to design against, and it is why the deployment above puts a staleness alert in step two rather than in a backlog. Two cheap safeguards cover it: alert if the current file is more than forty-eight hours old, at the point of distribution and again at the tenant, so a broken fan-out is caught as well as a broken retrieval — and have that check compare against the /stats endpoint, which reports the database's last update and requires no key, no credits and no authentication, so your monitoring path does not depend on the same credentials that might be the thing that broke.
Confirm the database size from the open statistics endpoint, batch the domains from alerts you have already investigated, and see what the hit rate looks like on your own book before anything reaches a roadmap. If the answer is worth having, the feed is the deployment that puts it in every tenant without a per-client line item.
