Domains
370.9Mlive domains
Domains that resolve. Names that no longer exist are left out. Measured daily.
Threat intelligence · MSSP partners
Your service in front. Our intelligence behind it.
Datazag holds what very few organizations have: the live domain corpus with its DNS history, certificate transparency, BGP routing and provider attribution, and the infrastructure links between them. You turn it into services for your clients.
SOC enrichment, cross-client exposure, email security reviews and reporting. Every finding comes with its evidence, and every service carries your brand.
Your managed service
Partner-branded offer
Reports, enrichment, portals, remediation workflows and account-review material delivered under your brand.
Powered by Datazag
Domains
DNS history
Certificates
BGP routing
Providers
Relationships
Evidence
What your service stands on
Very few organizations hold all of this.
Your clients’ domains are checked against all of these layers, not a single feed. Each layer is useful. Held together, with the links between them, they are hard to rebuild.
DNS history
Snapshots of each domain's records over time, with first-seen and last-seen dates.
Certificate transparency
16.5Mdomains no zone file lists
Certificates show us names that the usual domain lists miss.
BGP routing
3.1BIPv4 addresses in announced space
Who announces each address block, counted once however many routes cover it.
Network and provider attribution
79knetworks profiled
Each IP placed in the network that announces it, and each domain tied to the provider that runs its mail.
Relationships
Shared IPs, certificates, name servers and providers link one domain to the rest.
Each figure is measured and dated. See how in the Observatory →
Partner value
Launch new services. Keep the margin.
Use Datazag instead of building internet-scale collection, then package the same intelligence into new client-facing revenue lines.
Give analysts the evidence
Each finding arrives with its infrastructure context and the records behind it, so an analyst can check it rather than rebuild it.
Launch new services
Add SOC enrichment, email security reviews, exposure reports and portfolio monitoring without building the intelligence layer yourself.
Deliver under your brand
Keep the service experience inside your own portal, reports, account reviews and commercial model.
Integrate into your stack
Use webhooks, reports, exports, cloud data shares or the Microsoft Sentinel feed, depending on how your operations and customers already work.
Partner service catalog
Create services your clients already understand.
Choose the first commercial motion: SOC enrichment, cross-client exposure, email security reviews, client reporting, portal intelligence or a premium add-on to existing services.
SOC enrichment
Add domain, DNS, certificate, network, provider and relationship context to cases and investigations.
Domain contextDNS historyCertificatesNetwork and providerRelated infrastructure
Cross-client exposure
See which mail, DNS, hosting and CDN providers your clients share, so a provider problem shows up as one view across your client base.
Shared providersShared networksConcentrationClient-scoped views
Email security reviews
Show each client which of their domains can take mail, whether DMARC is enforced, and where their mail setup is incomplete.
DMARC enforcementSPFMTA-STSMail providerParked domains
Portfolio monitoring
Track posture and infrastructure changes across client domains, subsidiaries and suppliers.
DNS postureEmail postureHistorical changesProvider changes
Internet-scale findings
Put a client's estate in context with findings measured across the whole internet, the kind we publish in the Observatory.
ObservatoryBenchmarksDated figuresMethod notes
Client reporting
Create recurring security reports for account reviews, executive updates and remediation planning.
Executive summariesTechnical evidenceTrend analysisRemediation queuesWhite-label exports
Customer portal intelligence
Embed Datazag intelligence inside your own portal, dashboards and customer-facing service views.
Webhook eventsData sharesClient-scoped viewsCustom exports
How Datazag fits
Who does what.
You own the client, packaging and operational decisions. Datazag supplies the external intelligence and the delivery routes.
Area
Partner
Datazag
Client relationship
Partner owns the relationship
Datazag supports behind the scenes
Commercial packaging
Partner defines offer, pricing and SLA
Datazag supplies intelligence and delivery options
Internet-scale collection
Partner avoids building this
Datazag observes and links the infrastructure graph
Reports and portal
Partner brands the experience
Datazag powers findings, evidence and data exports
Operational workflows
Partner controls triage, blocking and escalation
Datazag supplies evidence, context and relationships
Commercial model
Built for partner margin, not channel conflict.
The model is designed so the MSSP owns the customer relationship, commercial packaging and service margin. Datazag provides the intelligence infrastructure as a predictable wholesale layer behind the offer.
Partner owns pricing
You decide how the service is packaged, bundled, marked up and sold to clients. Datazag does not set your end-customer price.
Datazag is the wholesale layer
The intelligence layer is priced by scope: client estate, domains, data volume, delivery route, white-label needs and SLA.
Designed for service margin
Partner terms are designed to leave room for meaningful managed-service margin without publishing a fixed discount or margin percentage.
No channel conflict by design
For partner-led accounts, the client relationship stays with the MSSP. Datazag remains infrastructure behind the managed service.
Margin principle
Partner price minus Datazag platform cost equals the service margin you control.
Partner economics depend on how the service is packaged: enrichment, reporting, remediation, portal intelligence or a premium add-on. Datazag is designed as a predictable input cost so partners can build repeatable recurring revenue around it. Specific discounts and margin targets are handled privately in the partner agreement.
Attach to existing clients
Add enrichment, email security reviews, exposure reporting or monitoring to accounts you already serve.
Use one intelligence layer
Reuse the same data across reports, portal features and SOC enrichment.
Reuse the evidence
The same findings and records feed reports and client reviews, so one investigation serves many outputs.
Package premium services
Sell evidence, monitoring, remediation and reporting rather than raw data access.
Usage rights
Built for services, not raw data resale.
Partners can package Datazag intelligence into their own managed services; Datazag data itself remains a licensed intelligence layer. Detailed terms are handled in the partner agreement.
Included
Use Datazag intelligence to power partner-led managed services, reports, enrichment workflows and portal features for your own end clients.
Not standalone resale
Raw data, data shares or bulk exports are not for resale, sublicensing, marketplace publication or standalone redistribution by default.
Downstream partners
Services sold through your own resellers, franchisees or channel partners require written approval, pass-through terms and a separate commercial model.
Operating model
From internet observations to partner revenue.
Datazag collects, links and explains the infrastructure signal. MSSPs turn it into services, decisions and recurring customer value.
1→
Observe
Datazag measures domains, DNS, certificates, routing and infrastructure changes.
2→
Enrich
Each observation is linked to its hosting, network, provider, related domains and history.
3→
Explain
Outputs include the evidence behind them, so each finding can be checked.
4→
Deliver
You receive webhook events, Sentinel indicators, reports or data shares through the route that fits your service model.
5
Monetize
You package it as SOC enrichment, email security reviews, exposure reporting or portal intelligence.
Delivery
Use the route that fits your service model.
The same intelligence layer can support analyst workflows, customer portals, managed reports, automated enrichment and data-driven partner products.
Webhooks
Push changes to your clients' domains and new findings into your existing ticketing or automation flows.
Reports and exports
Generate white-label evidence packs, account-review material and recurring client-facing reports.
Cloud data shares
Use Iceberg or Delta datasets for partner analytics, hunting, client-scoped views and large-scale enrichment.
Pilot path
Start with a small cohort, then package the service.
A partner pilot should prove the value of the intelligence, operational fit and commercial packaging before scaling across the client base.
Select a cohort
Choose a small group of clients, domains or use cases where external infrastructure intelligence should create visible value.
Connect delivery
Start with reports, webhook events, the Sentinel feed or a sample data view, depending on how your team wants to evaluate.
Validate the findings
Review the evidence, the triage fit and the reporting value for your client base.
Package the service
Decide whether the first commercial motion is enrichment, cross-client exposure, email security reviews or portfolio monitoring.
Questions
Frequently asked questions
- What can an MSSP build with Datazag?
- SOC enrichment, cross-client exposure views, email security reviews, portfolio monitoring, client reporting and features inside your own portal, all delivered under your brand.
- Do we need to build our own data collection?
- No. Datazag observes domains, DNS, certificates, routing and providers across the internet and links them together. You use the results through webhooks, the Sentinel feed, reports or data shares.
- What is cross-client exposure?
- A view of which mail, DNS, hosting and CDN providers your clients share, so a problem at one provider shows up as one view across your client base.
- Who owns the client relationship?
- You do. You set the offer, pricing and SLA, and the service runs under your brand. Datazag stays behind it.
Next step
Build the partner offer around your clients.
Start with a client cohort, validate the intelligence, then decide whether the first commercial motion is SOC enrichment, cross-client exposure, email security reviews, reporting or portfolio monitoring.