The data is weighted toward malicious and abusive infrastructure, so the signal you're hunting for isn't buried in noise.
From one domain
to the Whole Campaign
Search a domain or IP address and follow its DNS history to the infrastructure behind phishing, brand abuse and malicious campaigns.
Search completed. Found 10 records in 0.455s Select a result to pivot from it
| Name | Type | Value | Times Seen | First Seen | Last Seen |
|---|---|---|---|---|---|
| example.com | A | 93.184.216.34 | 1,284,091 | 2025-10-23 04:11 | 2026-03-14 19:40 |
| example.com | A | 93.184.215.14 | 412,377 | 2026-03-14 19:52 | 2026-10-22 13:58 |
| example.com | AAAA | 2606:2800:220:1:248:1893:25c8:1946 | 986,512 | 2025-10-23 04:12 | 2026-10-22 13:41 |
| example.com | NS | a.iana-servers.net. | 3,551,208 | 2025-10-23 04:11 | 2026-10-22 14:02 |
| example.com | NS | b.iana-servers.net. | 3,549,876 | 2025-10-23 04:11 | 2026-10-22 14:02 |
| example.com | MX | 0 . | 88,412 | 2025-11-02 09:27 | 2026-10-21 22:15 |
| example.com | TXT | "v=spf1 -all" | 74,903 | 2025-10-24 16:45 | 2026-10-22 08:33 |
| example.com | SOA | ns.icann.org. noc.dns.icann.org. 2024081457 7200 3600 1209600 3600 | 41,227 | 2026-01-19 11:06 | 2026-10-22 12:20 |
| www.example.com | A | 93.184.216.34 | 905,331 | 2025-10-23 04:13 | 2026-10-22 13:59 |
| www.example.com | AAAA | 2606:2800:220:1:248:1893:25c8:1946 | 512,880 | 2025-10-23 04:13 | 2026-10-22 13:47 |
There's more. Start a free trial to see every result.
Start free trialDISCLAIMER: This preview shows a limited sample of results. Times are in UTC.
Why Deteqtive
Every investigation touches DNS at some point. Deteqtive gives you the history: which IP addresses a domain has used, which domains have pointed to an address or range, and when each connection was first and last seen.
Explore Deteqtive
Everything you need to get started, from first questions to full documentation.
Investigate with trusted intelligence
Weighted toward threats
One API, every way in
The interface, API, MCP server, Real Time Streaming and Daily Downloads all draw on the same Passive DNS API, so the answer is the same however you ask.
From Spamhaus
Built by Spamhaus, whose independent threat intelligence has helped protect networks and email worldwide since 1998.
How Deteqtive works
Start with a domain, hostname or IP address. Deteqtive shows every connection it has seen, when it was first and last seen, and how often. Each answer is the next question, so one lead takes you to the rest of the infrastructure behind it.
See how it worksPivot from one lead to the next
Go forward from a domain to every IP address it has used, or back from an IP address or range to every domain that has pointed there. Each result is a new starting point.
- Forward and reverse search
- Five ways to match a name, including subdomains and lookalikes
- Search single IP addresses or whole ranges
- First seen, last seen and sightings for every record
What is passive DNS?
Passive DNS is a record of DNS answers observed over time. It shows which IP addresses a domain has used and which domains have pointed to an address, even after the records have changed.
How do I try Deteqtive?
Can I use Deteqtive in my own tools?
Want to access
the platform?
Spamhaus is committed to protecting and respecting your privacy. We’ll only use your personal information to respond to your enquiry, manage any accounts you may set-up, and to provide the products and services you request from us. From time to time, we would like to contact you about our products and services, as well as other security related content that may be of interest to you. If you consent to us contacting you for this purpose, please tick the box below.
You can unsubscribe from these communications at any time. For more information on how to unsubscribe, our privacy practices, and how we are committed to protecting and respecting your privacy, please review our Privacy Notice.
By clicking submit below, you consent to allow Spamhaus to store and process the personal information submitted above to provide you the content requested.
I agree to receive other communications from Spamhaus.