RiskIQ PassiveTotal is retiring into Microsoft Defender. Keep the domain watch, signed.

RiskIQ PassiveTotal was the tool a lot of analysts reached for to look a domain up: its passive-DNS history, its certificates, and how its records had moved over time. Microsoft acquired RiskIQ in 2021, replaced PassiveTotal with Microsoft Defender Threat Intelligence, and the legacy Microsoft Threat Intelligence portal that carried the PassiveTotal experience forward is set to close on 1 August 2026. RiskIQ Community Edition, the no-cost tier many people learned on, went with it. (Source: Microsoft, RiskIQ acquisition, 12 July 2021; Microsoft Threat Intelligence portal retirement notices, 2026.)

What people actually used it for

PassiveTotal did a great deal, but a large part of the daily use was one concrete question: pull up a domain and see what it resolves to, who issued its certificate, and what changed since last time. Community Edition made that reachable without a contract, which is why so many analysts have it in muscle memory. That specific job is the one worth replacing directly.

The part DomainDrift covers

DomainDrift covers one slice of that, and covers it fully. It reads the public surface of a domain, continuously, and records every change to its DNS, certificates, registry records, mail and hosting. The difference from a lookup tool is the record: every reading is Ed25519-signed the moment it is taken and dated on a public chain, so you hold a dated, checkable history of the domain, one you can return to on any day.

A signature proves who took a reading and that it has not changed; the chain anchor proves when it existed. Correctness stays a separate question you check yourself, against keys we publish. Signing is added trust. See how to verify.

If the part you relied on PassiveTotal or Community Edition for was watching how a domain's DNS and certificates change, and being able to prove what a domain looked like on a given day, that is the slice DomainDrift is built for. See also our note on the wider RiskIQ platform end of life.

Type any company at domaindrift.io and watch its domain get read apart, signed and dated. Looking is free; keeping the record is an account.