Reports
Executive and technical views for domain posture, platform exposure and remediation.
Domain Health
Platform Map
DNS Review
Recommendations
Internet Infrastructure Intelligence
Your threat feeds see attacks. We see them being built.
Datazag maps malicious infrastructure at certificate issuance — surfacing whole campaigns before the first domain attacks — and delivers scored, annotated intelligence straight into your SIEM, warehouse and controls.
150 domains from one signal — 0 in public domain feeds→
~10s from certificate to scored alert
Up to 48h ahead of blacklists
Your slice of the graph
360M+ domains. You care about the ones aimed at you.
You tell us what you operate, own and protect. That scope carves the full infrastructure graph down to the domains, certificates and networks being built against your organisation — and what comes out is a watchlist, not a firehose.
Platforms you operate
The SaaS, cloud and payment platforms your business runs on — the infrastructure attackers imitate to reach your people.
Brands you own
Your names, product marks and domains — the strings attackers register against, character-swap and wrap in certificates.
Keywords you protect
Campaign terms, executive names, product launches — the language your attackers borrow before they send anything.
Out the other side
Your watchlist — the infrastructure targeting you.
ScoredReason codesConfidence tiersDeduplicated
Every entry arrives scored and explained, so it can be triaged, blocked or escalated without a human re-deriving why it matters.
Relationship Intelligence
Signals reveal relationships. Relationships become intelligence.
A certificate, DNS change or routing event is only the first clue. Datazag uses it as a pivot into related domains, IPs, certificates, providers, networks and historical observations.
That relationship context turns one signal into a wider campaign view. Intelligence then becomes evidence packaged for the way each team works: reports, alerts, APIs and cloud data shares.
1Signal
2Relationships
3Campaign surface
4Intelligence
5Evidence packages
See this exact pivot run on a real criminal hosting cluster: One Signal, 150 Domains →
New certificate or DNS change
First suspicious domain
Shared IPs
Related domains
Shared certificates
Providers
ASN / prefix
Historical context
Campaign blast area
Relationship Intelligence
Reports
Alerts
API
Data shares
Detection quality
Every alert earns its confidence score.
A suspicious domain doesn’t become an alert because one signal fired. It has to survive four independent checks — each looking at evidence the others can’t see.
- 01
DNS profile match
Does its DNS configuration match how the impersonated platform actually resolves — or how attackers stage it?
- 02
Infrastructure risk
Where does it live? Hosting network, IP abuse history, certificate patterns — scored against 360M+ domains of prior observation.
- 03
Website check
What's actually being served? Content and behaviour, checked against the platform it claims to be.
- 04
AI analyst review
A final adjudication pass over the full evidence before a high-confidence verdict — the same review, on every alert, at machine speed.
Every alert ships with its confidence tier and the reasons behind the score — so you set the threshold. Block high-confidence automatically; route the rest to review. And because every verdict is explainable, every disagreement is auditable: you can see exactly why we flagged it, and tell us when we're wrong.
Missed threats are the failure you never see — so we don’t hunt domain by domain. One confirmed signal pivots to the entire hosting cluster, surfacing the domains no per-domain scanner would ever individually flag. We found 150 that way from a single certificate →
Into your stack
Explainable signals flow into controls you already operate.
One platform · multiple delivery methods
The same intelligence graph powers every output.
Reports, alerts, APIs and datasets are not separate products. They are different ways to consume Datazag's continuously updated infrastructure intelligence.
Datazag Intelligence Platform
Infrastructure Graph
Domains, DNS, certificates, hosting, ASNs, platforms, history, evidence and risk context.
Alerts
Real-time intelligence for SOC workflows, partner monitoring and platform abuse teams.
Webhooks
SIEM
Splunk
Sentinel
API
Lookup, score and enrich domains, infrastructure and platform indicators inside your products.
REST
Bulk Lookup
Risk Scoring
Evidence
Cloud Datasets
Continuously refreshed intelligence delivered into your analytics and marketplace stack.
Snowflake
Databricks
Iceberg
Delta
The internet right now
Live observations from the Datazag Intelligence Platform.
Datazag continuously observes public internet infrastructure and turns domains, certificates, DNS, routing and platform relationships into operational intelligence.
Certificate streamlive
DNS intelligencelive
Risk scoreslive
Infrastructure graphlive
360M+
Domains monitored
Continuously correlated against DNS, certificates and infrastructure history.
10M+
IPs hosting domains
IP addresses currently linked to domains in the Datazag corpus.
4.3B
IPv4 addresses indexed
Total IP space indexed for context and infrastructure correlation.
78k
Networks profiled
ASN ownership and routing context for infrastructure intelligence.
Coverage model
Infrastructure relationships, not threat-feed lists.
Public telemetry is normalised into Datazag's own graph so customers see explainable relationships, provider context and historical change rather than isolated indicators.
DNS intelligence
Certificate intelligence
Subdomain intelligence
Routing context
Provider and platform mapping
Datazag Observatory
Explore the relationships behind the internet.
Search, pivot, visualise and download aggregated infrastructure intelligence from Datazag's continuously updated internet graph.
The same pivot builder mapped 150 domains from a single signal: read the investigation →
Snapshot 06:00 UTC
412
New domains
last hour
83
Alert candidates
scored
17
Routing changes
snapshot
Pivot builder
Preview
ProviderASNPlatformTLDRisk
Cloudflare
Microsoft
Google
Amazon
Timeline
Graph
Who it’s for
One intelligence layer. Four ways in.
MSSPs
White-label investigations and earlier alerts across your whole client base.
Explore→Insurers
External infrastructure signal for underwriting and portfolio monitoring.
Explore→ESPs
Safer sending and onboarding decisions from infrastructure intelligence.
Explore→Enterprise
Scored, explainable intelligence delivered into the stack you already run.
Explore→Free Domain Health Report
See your organisation through an attacker's eyes—for free.
Datazag reviews public DNS, visible platforms, subdomains, certificates and infrastructure exposure, then sends a detailed multi-page report for technical and executive teams.
No questionnaire
No asset inventory
Public infrastructure only
Delivered by email
We use publicly observable infrastructure signals. No agent, questionnaire or asset inventory is required.
Generated analysis
What happens next
The report is generated from live checks, platform fingerprints, subdomain review and infrastructure intelligence.
DNS analysed✓
Platforms mapped✓
Subdomains reviewed✓
Certificates checked✓
Risk calculated✓
Multi-page report
Domain Health Report
example.com
Multi-page
Medium risk
Executive summary
Overall risk · key exposure · priority actions
Platform exposure
Microsoft 365 · Cloudflare · Google Workspace
DNS & subdomain health
SPF · DMARC · MTA-STS · ownership · takeover signals
Technical findings
Evidence, context and prioritised remediation
Recommended action
Review email authentication, exposed platforms and subdomain ownership before attackers exploit weak signals.