How
Deteqtive works?

Understanding the platform

How it works

This page walks through Deteqtive from first search to finished investigation: what it does, how teams use it and the value it adds. Below, you'll find the four steps of an investigation, a picture of how the pieces fit together, and the guides to get you started.

• What it does

  Deteqtive gives you DNS history. Search forward from a domain to every IP address and record it has used, or back from an IP address or range to every domain that has pointed there. Every result shows the record type and value, when it was first and last seen, and how often.

• How it’s used
  • Brand protection teams find lookalike domains and any domain using their brand, and see when each was first seen.
  • AI agent builders let agents query and pivot through DNS history over MCP.
  • Analysts investigate and pivot by hand in the web interface.
  • Penetration testers map an organisation's external footprint before an authorised test: the hosts seen under its domains and the addresses they've used.
  • Security engineers enrich alerts and automate lookups through the API.
  • Data and platform teams feed new observations into detection and analytics with Real Time Streaming, or keep their own copy current with Daily Downloads.

• The value

  One suspicious domain can lead you to the rest of the infrastructure behind it. The first and last seen dates tell you whether that infrastructure is new, still active or long gone. And because the data is weighted toward malicious and abusive activity, what you're hunting for isn't buried in noise.