From data to intelligence
Spamhaus’ Passive DNS offerings have always given you the raw data: domains, IPs, and the history connecting them. What it hasn't given you, until now, is a fast way to work with that data when you're mid-investigation.
That's the gap Deteqtive closes. It's not a replacement for the API or the feed; it sits on top of them; you spend less time collecting and organizing data and more time acting on it.
As one product manager at ZeroFox puts it: "We start from apex domains and we want to understand the zone, pivot to IP addresses and find correlations." That's exactly the workflow Deteqtive is built around.
What's new
Search, pivot, and pattern match: This is the core of Deteqtive and where it earns its name. You can:
- Run fuzzy or exact searches across domains and IPs.
- Pivot forward and backward: every IP a domain has used, and every domain that's pointed to a given IP or CIDR block.
- Search by CIDR block directly.
- Spot typosquats and lookalike domains targeting your brand, automatically.
A single lookalike domain rarely tells the whole story. Pattern matching helps you build the full picture: the campaign, the infrastructure behind it, and the other domains associated with it.
API-first and built for AI agents: Everything in the UI is also available as a REST API, NDJSON bulk export, or via an OpenAPI spec, so however your team works, Deteqtive fits in rather than forcing a new process. We've also added MCP integration, so AI agents can query Deteqtive directly and get answers back in your existing workflows.
Broader DNS coverage: Deteqtive draws on more record types and greater depth than before, the corpus is weighted toward malicious and abusive infrastructure. That means the signal you're hunting for isn't buried in noise.
Why this matters for your investigations
Whether you're a security analyst hunting down suspicious infrastructure, a malware researcher trying to skip a few hours of reverse engineering, or a brand protection specialist watching for spoofed domains, the question is usually the same: what else is connected to this? Deteqtive is built to answer that question quickly, with data you already trust.
How do you access Deteqtive?
Deteqtive passive DNS intelligence is in early access - learn more here or get in touch if you have any questions.
This is the beginning, not the finished product. We'll be expanding coverage, adding new capabilities, and shipping updates regularly, and we'd love your feedback as we go.