The DomainDrift blog

Reading the internet, signed.

Plain writing on watching how domains change, and on the tools that used to do it. Open to read. The newsletter is a separate, paid read for account holders.

• RiskIQ reached end of life. How to keep watching your domains.The standalone RiskIQ platform ended in 2024. Here is a signed, verifiable way to do the domain and DNS part.2026-08-16
• Expanse became Cortex Xpanse. What if you just want the domain watch?Expanse was folded into Palo Alto Cortex Xpanse. For the domain and DNS observation slice, there is a lighter, signed option.2026-08-16
• Cisco Umbrella's legacy APIs are ending. Watching domain and DNS change, signed.Legacy Umbrella APIs and offers reached end of life through 2023 and 2024. For the domain and DNS watch, a signed record.2026-08-16
• What signed internet telemetry is, and what a signature proves.A plain explanation of what it means to sign a reading of the internet, and exactly what that proof covers.2026-08-16
• How to watch a vendor’s domain posture without asking the vendor for anything.You do not need a vendor’s cooperation to watch their public infrastructure change. Here is how, and how to prove it.2026-08-16
• RiskIQ PassiveTotal is retiring into Microsoft Defender. Keep the domain watch, signed.PassiveTotal moved into Microsoft Defender Threat Intelligence, and the legacy portal closes in 2026. Here is a signed way to keep the domain and DNS part.2026-08-16
• Farsight DNSDB moved into DomainTools. If you just want the domain watch, signed.Farsight Security and its DNSDB passive-DNS database were acquired by DomainTools in 2021. For the focused domain and DNS watch, a signed record.2026-08-16