RiskIQ

aid: riskiq
deliveryModel:
  model: unknown
  open_source: false
  commercial: false
  callable_host: false
  label: Delivery model not determined — needs a product licence on record
  confidence: low
  source:
  - none
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: unknown
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Unknown
  confidence: low
  probe_state: none
  source:
  - security
  generated: '2026-11-06'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/riskiq.png
name: RiskIQ
description: RiskIQ was a San Francisco-based external threat intelligence and attack surface management company, known for
  its PassiveTotal platform (passive DNS, WHOIS, SSL certificate and host-pair intelligence), Digital Footprint external asset
  discovery, and External Threats brand/phishing detection. It exposed a developer REST API at api.riskiq.net and a research
  console at community.riskiq.com. Microsoft acquired RiskIQ in 2021 and folded its technology into Microsoft Defender Threat
  Intelligence (MDTI) and Microsoft Defender External Attack Surface Management (Defender EASM). As of this enrichment pass
  the riskiq.com domain runs on Microsoft/Azure infrastructure and www.riskiq.com issues a 301 redirect to the Microsoft Defender
  Threat Intelligence product page; the standalone RiskIQ/PassiveTotal API hosts (api.riskiq.net, community.riskiq.com) no
  longer accept connections. This profile is retained as a historical/acquired-company record with no live, independent API
  surface to enrich.
url: https://www.microsoft.com/security/business/siem-and-xdr/microsoft-defender-threat-intelligence
x-type: company
x-source: vc-portfolio
x-backed-by:
- battery-ventures
x-tier: stub
x-tier-reason: 'defunct standalone API: acquired by Microsoft 2021; riskiq.com 301s to Microsoft Defender Threat Intelligence,
  API hosts unreachable (enrichment pass 2026-11-05, local-v6; was portfolio-lead)'
x-status: acquired
x-acquired-by: microsoft
x-successor: https://www.microsoft.com/security/business/siem-and-xdr/microsoft-defender-threat-intelligence
specificationVersion: '0.23'
created: '2026-07-17'
modified: '2026-11-05'
tags:
- Company
- Security
- Threat Intelligence
- Attack Surface Management
- Cybersecurity
- Passive DNS
- Acquired
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: Security
  url: https://techcommunity.microsoft.com/tag/security
- type: Leadership
  url: https://news.microsoft.com/leadership
- type: DeveloperPortal
  url: https://developer.microsoft.com/en-us
- type: ChangeLog
  url: https://developer.microsoft.com/en-us/changelog
- type: Blog
  url: https://techcommunity.microsoft.com/category/windows/blog/windows-itpro-blog
- type: GettingStarted
  url: https://learn.microsoft.com/en-us/adaptive-cards/sdk/rendering-cards/android/getting-started
- type: Documentation
  url: https://developer.microsoft.com/
- type: Compliance
  url: https://www.microsoft.com/en-us/trust-center
- type: LLMsTxt
  url: llms/riskiq-llms.txt
- type: SecurityTxt
  url: well-known/riskiq-security.txt
- type: WellKnown
  url: well-known/riskiq-well-known.yml
- type: Hosts
  url: hosts/riskiq-hosts.yml
- type: Vendors
  url: vendors/riskiq-vendors.yml
- type: TermsOfService
  url: https://www.microsoft.com/en-us/legal/terms-of-use
- type: Support
  url: https://support.microsoft.com/en-us
- type: PrivacyPolicy
  url: https://www.microsoft.com/privacy?icid=DSM_Footer_Company_Privacy
- type: Pricing
  url: https://www.microsoft.com/en-us/security/pricing-overview
- type: TrustCenter
  url: security/riskiq-trust-center.yml
- type: VulnerabilityDisclosure
  url: security/riskiq-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/riskiq-domain-security.yml
- type: Website
  url: https://www.microsoft.com/security/business/siem-and-xdr/microsoft-defender-threat-intelligence
  name: Microsoft Defender Threat Intelligence (successor to RiskIQ)
- type: GitHubOrganization
  url: https://github.com/riskiq
apis: []
x-enrichment:
  date: '2026-11-05'
  status: minimal
  artifacts_added: 1
  pass: local-v6
x-parent: microsoft
x-relationship: acquisition
x-coverage:
  state: none
  reason: defunct
  detail: www.riskiq.com 301-redirects to the Microsoft Defender Threat Intelligence page and the former API hosts api.riskiq.net,
    api.passivetotal.org and community.riskiq.com refuse connections; only two frozen PyPI clients remain.
  evidence:
  - url: https://www.riskiq.com/
    status: 301
  - url: https://api.riskiq.net/
    status: 0
  - url: https://api.passivetotal.org/
    status: 0
  - url: https://community.riskiq.com/
    status: 0
  checked: '2026-11-05'