Deteqtive
FAQs

Getting Started

• What is Deteqtive?

  Deteqtive is a passive DNS intelligence platform built by Spamhaus Technology. It lets you search DNS observations — which IP addresses a domain has resolved to, which domains share an IP or CIDR, and lookalike domains targeting a brand — to investigate phishing, brand abuse, and malicious infrastructure.

  Unlike a live DNS resolver, which only tells you what a domain resolves to right now, Deteqtive records each observation with when it was first and last seen and how often it was observed, so you can pivot across related infrastructure.

• What is passive DNS?

  Passive DNS is a technique for collecting and storing DNS records as they occur on the network, without actively querying DNS servers. Sensors observe DNS queries and responses at strategic network points, record the domain, record type, and resolved data, and timestamp each observation.

  This creates a historical record that you can query to answer questions like: "What IP addresses has this domain used over the past two years?", "What other domains are hosted on this IP?", or "When did this record first appear?"

  It is widely used in threat intelligence, incident response, brand protection, and infrastructure monitoring.

• How do I get an API token?

  Sign up for a free account — no credit card is required for the Free tier. Once logged in, your API token is available in your account dashboard.

  Set it as an environment variable so all your requests work immediately:

  export DETEQTIVE_TOKEN="your-api-token-here"
  

  Then pass it as a Bearer token in the Authorization header on every request.

• What is the base URL for the API?

  All API requests go to:

  https://api.deteqtive.com/api/v3/
  

  An OpenAPI specification is available at https://api.deteqtive.com/api/v3/openapi.yaml for generating client libraries in any language.

• How do I make my first query?

  A forward search (domain → DNS records) looks like this:

  curl -H "Authorization: Bearer $DETEQTIVE_TOKEN" \
    https://api.deteqtive.com/api/v3/rrset/em/example.com/A
  

  A reverse search (IP → domains) looks like this:

  curl -H "Authorization: Bearer $DETEQTIVE_TOKEN" \
    https://api.deteqtive.com/api/v3/rdata/93.184.216.34
  

  See the Getting Started Tutorial for a full walkthrough.