Skip to content

remove passivetotal module - #3122

Merged
liquidsec merged 1 commit into
devfrom
remove-passivetotal
May 21, 2026
Merged

remove passivetotal module#3122
liquidsec merged 1 commit into
devfrom
remove-passivetotal

Conversation

@liquidsec

@liquidsec liquidsec commented May 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

The PassiveTotal v2 API (api.passivetotal.org) is decommissioned. RiskIQ was acquired by Microsoft and the product was replaced by Microsoft Defender Threat Intelligence (MDTI), which is a different product with a different API surface (Microsoft Graph, Azure AD OAuth) and enterprise-only licensing. The free community tier this module relied on no longer exists.

Evidence

Confirmed by probing the documented endpoint and every plausible successor URL:

Endpoint Result
api.passivetotal.org/v2/account/quota TLS cert is *.azureedge.net (no SAN for the hostname); with --insecure returns HTTP 404 from df.onecloud.azure-test.net
api.passivetotal.org/v2/enrichment/subdomains?query=... Same 404
api.passivetotal.org/ (root) Same 404
www.passivetotal.org NXDOMAIN
api.riskiq.net NXDOMAIN
community.riskiq.com Connect-timeout
api.ti.defender.microsoft.com NXDOMAIN (MDTI doesn't have a dedicated API hostname — it routes through Microsoft Graph)

The passivetotal.org apex is parked under Azure Front Door (CNAME chain → www.riskiq.comriskiq-prod-erczd7ebchb3hmfk.z01.azurefd.net). There is no longer a working PassiveTotal API anywhere.

The successor (MDTI via graph.microsoft.com/v1.0/security/threatIntelligence/...) uses Azure AD OAuth, completely different request/response shapes, and is gated behind a paid Microsoft 365 E5 / Security Copilot license. That's a new module, not a URL update.

@liquidsec
liquidsec requested a review from ausmaster May 21, 2026 22:37

@ausmaster ausmaster left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RIP

@liquidsec
liquidsec merged commit f971cb2 into dev May 21, 2026
18 checks passed
@liquidsec
liquidsec deleted the remove-passivetotal branch May 21, 2026 23:00
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Performance Benchmark Report

⚠️ No current benchmark data available

This might be because:

  • Benchmarks failed to run
  • No benchmark tests found
  • Dependencies missing

@codecov

codecov Bot commented May 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90%. Comparing base (361c0cc) to head (24c9379).
⚠️ Report is 7 commits behind head on dev.

Additional details and impacted files
@@          Coverage Diff          @@
##             dev   #3122   +/-   ##
=====================================
- Coverage     90%     90%   -0%     
=====================================
  Files        445     443    -2     
  Lines      38792   38751   -41     
=====================================
- Hits       34715   34667   -48     
- Misses      4077    4084    +7     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants