Product Details

What is Passive DNS data?

This is anonymized DNS query data, collected from recursive DNS servers around the world. A number of different record types are collected including: IPs, domains, hosts, name servers, and canonical names. Our Passive DNS database shows the connections between these different internet records.

The Spamhaus team of researchers uses this passive DNS data on a daily basis to assist with their investigations and research.

Who can use Passive DNS?

A multitude of roles can benefit from using Passive DNS including:

  • Security professionals
  • Brand Protection Specialists
  • Malware Researchers

Find out how fTLD, the registry behind .bank and .insurance utilize Passive DNS data to ensure they have some of the most secure top-level domains in the industry.

How can Passive DNS be accessed?

API – for security vendors and expert users who wish to integrate our raw datasets with their own software and security platforms.

Continuous data feed – for inclusion into third-party security products and organizations, including those of law enforcement agencies, who wish to continuously monitor live recursive DNS traffic to aid the identification of new malicious domains, emerging threats, or cybercriminal trends.

How can you use Passive DNS data?

Searching real time and historic Passive DNS data enables you to undertake various research tasks:

  • Investigate suspicious domains by revealing their current and historical IP address associations.
  • Research IP addresses or domains that have raised suspicion and see if it’s a single entity or multilayered operation.
  • Reveal the health of your hosting network by discovering what other domains and organizations are associated with the IP blocks and nameservers used by your hosting provider.
  • Analyze lookalike domains to evaluate their threat potential.
  • Detect infringement of your copyright and brands by detecting spoofed domains.
  • Uncover previously unknown areas of your network by searching for subnets of domains.
  • Reduce the need for complex reverse engineering when dealing with malware.


  • PRO | API access | $10,000 per year – 2,500 queries per day, 25,000 queries per month.  Sign-up to trial the PRO plan for 30 days.
  • ENTERPRISE | API access | $60,000 per year – 25,000 queries per day, 250,000 queries per month.
  • ENTERPRISE + |  Real time data feeds | $120,000 per year – unlimited queries subject to fair use principles.

For a detailed understanding of what is included in each tier, see our subscription breakdown..