RiskIQ reached end of life. How to keep watching your domains.

RiskIQ ended its standalone platform on 30 June 2024, after Microsoft acquired the company in 2021 and folded its threat-intelligence and attack-surface work into Microsoft Defender Threat Intelligence and Defender External Attack Surface Management. Teams that ran RiskIQ on its own were told to migrate. (Source: Microsoft Security Blog, 2021; the 2024 end-of-life notices.)

What people actually used it for

RiskIQ did a lot. A large part of the daily use, though, was narrow and concrete: watch the domains and subdomains an organisation and its vendors expose, and see when the DNS, the certificate, the mail provider or the host behind them changed. That is the part that felt like it went missing when the standalone tool closed.

The part DomainDrift covers

DomainDrift covers one slice of that work, and covers it fully. It reads the public surface of a domain, continuously, and records every change: DNS, certificate transparency logs, registry records, mail, and reachability. The difference from a live-lookup tool is the record. Every reading is Ed25519-signed the moment it is taken and dated on a public chain, so you hold a dated, checkable history of the domain, one you can return to on any day.

A signature proves who took a reading and that it has not changed; the chain anchor proves when it existed. Correctness stays a separate question you check yourself, against keys we publish. Signing is added trust. See how to verify.

If what you relied on RiskIQ for was watching a portfolio of domains for infrastructure change, and being able to prove what a domain looked like on a given day, that is the slice DomainDrift is built for. Watch your own estate for a change nobody authorised, watch a vendor's domains without asking them for anything, or catch a lookalike the moment it switches on a mail server.

Type any company at domaindrift.io and watch its domain get read apart, signed and dated. Looking is free; keeping the record is an account.