Deteqtive: A quick recap...
Deteqtive is Spamhaus’ passive DNS intelligence platform. Search any domain or IP address and see its DNS history, including every IP address a domain has pointed to, the domains seen on an IP address, and when each was first and last seen. From there you can pivot from a single indicator to the full campaign, in the web interface, via API, or directly using AI agents over MCP. The fuzzy and exact match search helps surface phishing campaigns, brand infringement and malicious domains.
And, now there’s even more…
What's new: DNS intelligence in your own systems
Many early access users were impressed by Deteqtive’s search capabilities. Enterprise users, in particular, wanted to integrate its passive DNS data into their own detection pipelines and threat intelligence platforms. We have introduced two new Enterprise-tier features that do exactly that:
-
Real-time streaming sends new DNS observations to your own systems as we see them, over one connection for each record type. If the connection drops, your client picks up from where it left off, so nothing is missed.
-
Daily downloads publish compressed files throughout the day, each covering four hours of observations for one record type. Load them on your own schedule. Files never change once they're published, so you only ever download what's new.
Both of these options include A, AAAA, CNAME, MX, NS and TXT records. If you choose to integrate the data this way, you can also use the Deteqtive web interface, API and MCP server, so your analysts are free to investigate the same data your systems hold.
Technical documentation
To help with set up, we've published dedicated pages for:
“An irreplaceable part of our platform”
Some early access users went further than testing. Have I Been Squatted, which detects and takes down malicious domains targeting its customers, connected its AI agents to Deteqtive over MCP and treated it as a production system from day one.
The Cybersecurity Team Lead shared: “Detecting and responding to malicious infrastructure requires insight that conventional signals simply do not capture. Spamhaus Deteqtive provides that insight along with the controls to query at scale. It has become an irreplaceable part of our platform, powering our signals and MCP agents for all of our customers.”
Making Deteqtive work for you
Have I Been Squatted is just one example of how customers are using Deteqtive. This latest release opens up the platform to fit the ways different teams already work:
-
Security Engineers can stream new DNS observations into detection pipelines, or load daily downloads according to their own schedule.
-
Brand protection teams can find any domain using their brand, with five ways to match a name: exact matches, right match (subdomain), left match (parent domain), fuzzy match (for typosquats), word match.
-
Analysts and threat hunters can pivot by hand in the web interface, from domain to IP address and back (approx 12 months history).
-
Penetration testers can map an organization's external footprint before an authorized test: subdomains, the addresses behind them and how they've changed.
So, what's next?
If you were part of early access, we’d like to say thank you. Your feedback is the driver behind what we're releasing today. Looking ahead, our roadmap for the coming months focuses on an updated UI including AI analytics and providing the MCP server through the official Anthropic connector library, with much more to come in 2027
Equally, if there’s a new feature or functionality you’d like to see in Deteqtive, let us know.
Ready to try the data?
Sign up for a 7-day free trial, or alternatively talk to the team; tell us what you're investigating and how you'd like to use the data, and we'll show you how you can work with Deteqtive.