Beat the adversary with 22B+ events a day

The most complete public map of the internet

Revisit more than 400 million services every day across more protocols than web-first internet search, with first-party observations connected to DNS, fingerprints, network attribution, proxy intelligence, exposed content, and reporting.

Make your first request →Explore investigations

The Infrawatch platform

Explore internet infrastructure data

Start with the data product that answers your question. Move between them as the investigation expands.

Platform overview →

Scanning

Hosts, services, protocols, fingerprints, and exposure history

›

DNS

Observed name-to-address relationships over time

›

Residential Proxies & VPNs

Observed endpoints, providers, networks, and service evidence

›

Reports

Published intelligence and extracted indicators

›

Open Directories

Indexed directory listings, files, metadata, and classifications

›

External Surface Intelligence

Owned-asset inventory, curated services, and worked findings

›

One connected map

Ask questions that cross datasets

Combine direct observations and derived context in one search. Find infrastructure classified as a proxy, serving a particular application, in a specific country-then pivot into its DNS history, fingerprints, reports, and exposed files.

InfraQL

services.tags.category:proxy/*
AND country_code:DE
AND same_service(
  protocol:https
  AND http.title="Grafana"
)

Work with the data

Keep the investigation moving

Projects

Keep investigations, indicators, notes, saved queries, and activity together.

InfrAI

Ask InfrAI to explore evidence and build a connected investigation graph.

External Surface

Inventory what your organisation exposes and work the findings raised against it.

Get started

Follow an analyst workflow

Start with a real question, follow the evidence, then adapt the query to your own indicators.

Investigate an IP

Build host context, inspect services, pivot through DNS, and find related reporting.

Pivot through passive DNS

Move between names and addresses and understand when each relationship was observed.

Hunt exposed services

Combine protocol, network, HTTP, TLS, fingerprint, and tag evidence.

Need to enrich a list? Use bulk lookup →

Build with Infrawatch

From first query to production integration

Learn InfraQL

Use typed fields, time windows, correlation, patterns, and validation.

Explore the API

Browse authentication, endpoint contracts, schemas, and examples.

Inspect the fields

Find public fields, types, operators, and dataset-specific semantics.