Internet Infrastructure Intelligence
Your threat feeds see attacks. We see them being built.
Datazag maps malicious infrastructure at certificate issuance — surfacing whole campaigns before the first domain attacks — and delivers scored, annotated intelligence straight into your SIEM, warehouse and controls.
Coverage
The graph behind that answer.
Finding the other 149 domains means already holding the ones they connect to. This is what Datazag observes, and what each figure counts.
- 360M+
- Domains monitored
- 13M+
- IPs hosting domains
- 3.1B
- IPv4 addresses indexed
- 79k
- Networks profiled
Distinct domains that resolve — every name answering with a record or an empty response. Names that no longer exist (NXDOMAIN) and names whose servers failed or timed out are excluded, so this counts the live corpus rather than every domain ever queried.
Measured 24 Sept 2026, 00:27 UTC
Distinct IPv4 addresses that a domain in the measured corpus resolves to, taken over the same population as the domain figure above.
Measured 24 Sept 2026, 00:27 UTC
IPv4 space announced in BGP and attributed to a network, counted once per address however many announcements cover it — a more-specific prefix inside its parent is not counted twice.
Measured 24 Sept 2026, 00:27 UTC
Autonomous systems with ownership and routing context attached, used to place infrastructure in the network that announces it.
Measured 24 Sept 2026, 00:27 UTC
Coverage measured 24 September 2026. What the internet is doing right now — certificates, newly observed domains, routing changes — lives in the Observatory.
Relationship Intelligence
Signals reveal relationships. Relationships become intelligence.
A certificate, DNS change or routing event is only the first clue. Datazag uses it as a pivot into related domains, IPs, certificates, providers, networks and historical observations.
That relationship context turns one signal into a wider campaign view. Intelligence then becomes evidence packaged for the way each team works: reports, alerts, APIs and cloud data shares.
See this exact pivot run on a real criminal hosting cluster: One Signal, 150 Domains →
Into your stack
Explainable signals flow into controls you already operate.
One platform · multiple delivery methods
The same intelligence graph powers every output.
Reports, alerts, APIs and datasets are not separate products. They are different ways to consume Datazag’s continuously updated infrastructure intelligence.
Datazag Intelligence Platform
Infrastructure Graph
Domains, DNS, certificates, hosting, ASNs, platforms, history, evidence and risk context.
Reports
Executive and technical views for domain posture, platform exposure and remediation.
Alerts
Real-time intelligence for SOC workflows, partner monitoring and platform abuse teams.
API
Sender diligence for email service providers: assess the domains a sender uses, and get the evidence behind the answer rather than an approve-or-reject verdict.
Datasets
Infrastructure intelligence in your own warehouse, to join against your own tables. This is the route for enrichment at scale.
Datazag Observatory
The internet, measured daily.
Open statistics from Datazag's continuously updated internet graph: email authentication, routing hygiene, hosting concentration, domain parking and impersonation. Explore, compare, visualize and cite — every figure carries its date and population.
The same graph mapped 150 domains from a single signal: read the investigation →
Live from the Observatory
Data as of 2026-09-09
367.2M
resolving domains measured
domains in gold.dns_wide that resolve · as of 2026-09-09
Method and denominator →
49.56%
of DMARC records at enforcement
86.2M domains publishing DMARC · as of 2026-09-09
Method and denominator →
97.23%
of multi-origin prefixes are stable multi-homing
193,325 MOAS prefixes observed · as of 2026-09-09
Method and denominator →
7
networks carry half of all attributable domains
51,805 networks observed carrying domains · as of 2026-09-09
Method and denominator →
Who it’s for
One intelligence layer. Four ways in.
MSSPs
White-label investigations and earlier alerts across your whole client base.
Explore→Insurers
External infrastructure signal for underwriting and portfolio monitoring.
Explore→ESPs
Safer sending and onboarding decisions from infrastructure intelligence.
Explore→Enterprise
Scored, explainable intelligence delivered into the stack you already run.
Explore→Free Domain Health Report
See your organization through an attacker's eyes—for free.
Datazag reviews public DNS, visible platforms, subdomains, certificates and infrastructure exposure, then sends a detailed multi-page report for technical and executive teams.
Not ready to enter an email? View a sample report
We use publicly observable infrastructure signals. No agent, questionnaire or asset inventory is required.
Generated analysis
What happens next
The report is generated from live checks, platform fingerprints, subdomain review and infrastructure intelligence.
Multi-page report
Domain Health Report
example.com
Executive summary
Overall risk · key exposure · priority actions
Platform exposure
Microsoft 365 · Cloudflare · Google Workspace
DNS & subdomain health
SPF · DMARC · MTA-STS · ownership · takeover signals
Technical findings
Evidence, context and prioritized remediation
Recommended action
Review email authentication, exposed platforms and subdomain ownership before attackers exploit weak signals.