Threat Intelligence Provider
Threat Intelligence Provider
Quad9 provides to these threat intelligence partners a form of global visibility into malicious campaigns, actors, and other cyber criminal activities. We do this by creating and sharing anonymized telemetry in the form of a data feed of queries against the malicious domains they contribute into the platform. This means we only share the below data for queries that are blocked for domains provided by each company. (Meaning Company A only gets telemetry for domains that Company A submits for blocks).
As a threat intelligence provider, if you can contribute high-fidelity, low-false positive, actionable threat feed(s) into the Quad9 platform, we give you back the following attributes of queries for the domains you share with us:
- Timestamp of when the query occurred (in GMT)
- Fully qualified domain name of the resource requested
- DNS record type
- City/State/Country of where the resolution request originated from (based on geoip data/lookups)
We do not store or log to disk the source IP from which a query originated.
How to Start Contributing Threat Intelligence
Send an email to the following email address to begin discussion on data sharing.
threatintel@quad9.net
