The data is weighted toward malicious and abusive infrastructure, so the signal you're hunting for isn't buried in noise.
From one domain
to the Whole Campaign
Search a domain or IP address and follow its DNS history to the infrastructure behind phishing, brand abuse and malicious campaigns.
Sign in or create an account to get started.
Search completed. Found 10 records in 0.455s Select a result to pivot from it
| Name | Type | Value | Times Seen | First Seen | Last Seen |
|---|---|---|---|---|---|
| example.com | A | 93.184.216.34 | 1,284,091 | 2025-10-23 04:11 | 2026-03-14 19:40 |
| example.com | A | 93.184.215.14 | 412,377 | 2026-03-14 19:52 | 2026-10-22 13:58 |
| example.com | AAAA | 2606:2800:220:1:248:1893:25c8:1946 | 986,512 | 2025-10-23 04:12 | 2026-10-22 13:41 |
| example.com | NS | a.iana-servers.net. | 3,551,208 | 2025-10-23 04:11 | 2026-10-22 14:02 |
| example.com | NS | b.iana-servers.net. | 3,549,876 | 2025-10-23 04:11 | 2026-10-22 14:02 |
| example.com | MX | 0 . | 88,412 | 2025-11-02 09:27 | 2026-10-21 22:15 |
| example.com | TXT | "v=spf1 -all" | 74,903 | 2025-10-24 16:45 | 2026-10-22 08:33 |
| example.com | SOA | ns.icann.org. noc.dns.icann.org. 2024081457 7200 3600 1209600 3600 | 41,227 | 2026-01-19 11:06 | 2026-10-22 12:20 |
| www.example.com | A | 93.184.216.34 | 905,331 | 2025-10-23 04:13 | 2026-10-22 13:59 |
| www.example.com | AAAA | 2606:2800:220:1:248:1893:25c8:1946 | 512,880 | 2025-10-23 04:13 | 2026-10-22 13:47 |
Start a 7-day free trial to see every result.
Create accountDISCLAIMER: This preview shows a limited sample of results. Times are in UTC.
Put DNS history to work
Every investigation touches DNS at some point. Deteqtive gives you the history: which IP addresses a domain has used, which domains have pointed to an address or range, and when each connection was first and last seen.
Detecting and responding to malicious infrastructure requires insight that conventional signals simply do not capture. Spamhaus Deteqtive provides that insight, along with the controls to query at scale. It has become an irreplaceable part of our platform, powering our signals and Agents for all of our customers.
Cybersecurity Team Lead, Haveibeensquatted.com
Investigate with trusted intelligence
Weighted toward threats
One API, every way in
The interface, API, MCP server, Real Time Streaming and Daily Downloads all draw on the same Passive DNS API, so the answer is the same however you ask.
From Spamhaus
Built by Spamhaus, whose independent threat intelligence has helped protect networks and email worldwide since 1998.
Explore Deteqtive
Everything you need to get started, from first questions to full documentation.
FAQs
Answers to common questions about the data, access and pricing.
Read the FAQsDocumentation
The API reference for the Passive DNS API.
Read the docsBlog
Investigations, guides and news from the Spamhaus team.
Visit the blogStart free trial
Create an account and try Deteqtive free for 7 days on your own investigations.
Create account
Talk to
our team
Spamhaus is committed to protecting and respecting your privacy. We’ll only use your personal information to respond to your enquiry, manage any accounts you may set-up, and to provide the products and services you request from us. From time to time, we would like to contact you about our products and services, as well as other security related content that may be of interest to you. If you consent to us contacting you for this purpose, please tick the box below.
You can unsubscribe from these communications at any time. For more information on how to unsubscribe, our privacy practices, and how we are committed to protecting and respecting your privacy, please review our Privacy Notice.
By clicking submit below, you consent to allow Spamhaus to store and process the personal information submitted above to provide you the content requested.
I agree to receive other communications from Spamhaus.