For MSSPs, email platforms, cyber insurers and data teams
Internet infrastructure intelligence you can act on.
We track new and high-risk domains daily, with their DNS, certificates, and routing, to expose attack infrastructure as it’s built. Discover hidden assets, assess vendor risk, and power your email & security products with explainable intelligence.
Latest coverage: 373.2M resolving domains · measured 7 Oct 2026 · Explore the Observatory →
What can I use it for?
Choose your team and your problem.
MSSPs
Spot attacks on clients' platforms before they land.
Add pre-compromise intelligence to your SOC service, under your own brand.
Learn more →Email platforms
Vet senders and links, and keep bad actors off the platform.
See who runs a sender's domain and mail before you onboard them.
Learn more →Cyber insurers
See concentration and exposure across a book.
Find shared providers and weak email controls across your insureds.
Learn more →Data teams
Join infrastructure data to your own, in your warehouse.
Query our datasets next to your own tables, with no data leaving your account.
Learn more →Investors and M&A
Check a portfolio or a target's domain estate.
Get a portfolio snapshot or a full estate report for a group of companies.
Learn more →Free Domain Health Report
See your domain the way an attacker sees it.
Enter your domain and work email. We check your public infrastructure and email you the report.
Need the full picture? The Attack Surface & SaaS Discovery Report is $295. Buy the full report →
What the free report shows
Email controls
SPF, DMARC and MTA-STS, and what each one leaves open.
Platform impersonation
Lookalike domains that copy the platforms you rely on.
Hosting and subdomains
Where your domain is hosted, and which subdomains are exposed.
Not ready yet? View a sample report
Evidence and sample outputs
See exactly what you get.
Each sample uses our real output format, run on a fictional organization.
Attack Surface & SaaS Discovery Report
The full report for one domain: email controls, platform impersonation, hosting and subdomains, with a fix for each finding.
Samples use fictional organizations.
Coverage and methodology
What we see, and how we measure it.
We resolve DNS for every domain we know about. We read certificate transparency logs to find new names as certificates are issued. We add global routing data to place each address in the network that announces it. We collect all of this ourselves. We do not license threat feeds.
New and high-risk domains are checked daily. The full corpus refreshes about every two months.
- 1. Domains monitored: Domains in the Datazag corpus whose latest resolution returned records. Names that no longer exist (NXDOMAIN) and names whose servers failed are excluded. This is the figure the Datazag Observatory publishes as its corpus count.
- 2. IPs hosting domains: Distinct IPv4 addresses that a domain in the measured corpus resolves to, taken over the same population as the domain figure above.
- 3. IPv4 addresses indexed: IPv4 space announced in BGP and attributed to a network, counted once per address however many announcements cover it — a more-specific prefix inside its parent is not counted twice.
- 4. Networks profiled: Autonomous systems with ownership and routing context attached, used to place infrastructure in the network that announces it.
Delivery
Use the data where you already work.
Reports in the portal
Order and read reports in the Datazag portal. Estate orders include PDF, HTML and CSV files.
See the reports →Snowflake Marketplace
Get our IP-to-ASN dataset as a free Snowflake listing. Query it like any other table.
See the dataset →Datasets arrive in your own warehouse. You join them to your data there, so your data stays in your environment.
Datazag Observatory
The internet's infrastructure, measured.
Free to explore and cite.
Live from the Observatory
Data as of 2026-10-07
49.85%
of DMARC records at enforcement
90.4M domains publishing DMARC · as of 2026-10-07
Method and denominator →
98.04%
of multi-origin prefixes are stable multi-homing
194,377 MOAS prefixes observed · as of 2026-10-07
Method and denominator →
7
networks carry half of all attributable domains
53,013 networks observed carrying domains · as of 2026-10-07
Method and denominator →
Pricing
Start free. Pay when you need more.
Domain health reports
- Domain Exposure & DNS Hygiene Report: Free
- Attack Surface & SaaS Discovery Report: $295
Start with your own domain.
Get the free report and see what an attacker can see.