Internet-scale security data
Measure the internet. Defend what matters.
Measurable collects, derives, and operates large-scale datasets about the public internet, and builds the analytics on top of them.
Confidential by construction
A search is never an observation. Your queries and indicators stay yours, contractually.
Provenance and lineage
Every record is stamped with when, how, and against which source of truth it was observed.
One graph, every dataset
Pivot from a banner to a certificate to a domain to a sample without leaving the platform.
Defensive and lawful
We observe publicly reachable sources of truth. No unauthorized access, ever.
$ curl https://api.measurable.io/v1/atlas/pivot?ip=203.0.113.42 { "ip": "203.0.113.42", "asn": "AS64500 — Example Hosting", "first_seen": "2026-02-14", "domains": ["login-acme[.]help", "acme-sso[.]live"], "served_certs": 3, "ja4s": "t130200_1301_a56c5b99", "verdict": { "score": 87, "category": "phishing", "confidence": 0.91 } }
Illustrative response. Indicators are defanged and fictional.
Delivered the way your team already works.
Bulk into your lake, a replayable stream, or search — and into the tools you already run.
Foundational data, and the analytics built on it
Six observational corpora collected from sources of truth, plus derived products produced algorithmically from them, with full lineage back to the evidence. Available as bulk, stream, or search.
Foundational datasets
Resolve
Active DNSDaily resolution of the global DNS, with full typed responses and DNSSEC state.
Attest
CertificatesEvery CT-logged X.509 certificate, plus certificates we observe directly in the wild.
Detonate
Malware sandboxDynamic and static analysis with network artifacts, mapped to MITRE ATT&CK.
Canvas
Web crawlRaw responses, extracted text, page metadata, and the host hyperlink graph.
Horizon
Scan & bannersOpen ports, banners, and service fingerprints across IPv4 and known IPv6.
Registry
WHOIS / RDAPRDAP-native registration data for domains and IP resources, tracked over time.
Derived products
Genesis
New domainsFirst-seen domains, with age, registrar, nameservers, and lexical risk features.
Verdict
ReputationCalibrated, explainable risk scores for domains, IPs, ASNs, and certificates.
Atlas
Infrastructure graphEntities and time-stamped relationships across all six foundational datasets.
Affinity
SimilaritySubmit an entity, retrieve similar ones by fingerprint, embedding, or content.
Chronicle
Historical DNSWhich name pointed where and when, fused with certificate and port history.
Lineage
Malware clustersCluster samples by toolmarks and config, then link them to live infrastructure.
Where the catalogue ends, we build
Private analytics, bespoke models, custom indexes and graphs, and real-time dashboards, delivered into your environment or operated by us, in the region you require.
Talk to sales- Private, managed analytics
- Bespoke models
- Custom indexes & graphs
- Real-time dashboards
- Engineering & integration
- Retrospective threat hunts
On the roadmap: blockchain & on-chain, routing & BGP, credential-leak, mobile & app-store, software supply-chain, and AI threat-surface intelligence.
Three ways to consume the data
Every foundational dataset and most derived products ship through the same three mechanisms. Most customers combine them.
Bulk
Into your S3Partitioned Parquet, Avro, or JSONL (plus WARC for web data), with manifests and checksums. Snapshot plus delta.
- Data-lake ingestion
- ML training
- Backfills
Stream
Replayable eventsKafka-compatible, SQS, or Pub/Sub. Schema-registry backed, at-least-once delivery, with server-side filtering.
- Real-time enrichment
- “New since” triggers
- SIEM / SOAR feeds
Search
API and UIExact, faceted, ranged, and pivot/graph queries, with per-result lineage back to the underlying observations.
- Investigation
- Hunting
- Ad-hoc enrichment
Schemas are versioned with additive-first evolution and deprecation windows.
Built for the teams that defend the internet
One corpus and one graph, used across the security workflows that matter most.
Threat intelligence
Track adversary infrastructure from a single indicator across DNS, certificates, scans, and sandbox network artifacts.
Attack surface management
Inventory your external exposure and watch it drift, with daily scans and certificate discovery.
Phishing & brand protection
Catch look-alike domains and credential-harvest pages, often before a campaign goes live.
Fraud & trust and safety
Score domains, IPs, ASNs, and certificates with calibrated, explainable risk you can audit.
Incident response
Pivot and retrospectively hunt across years of historical resolutions and infrastructure.
Vulnerability & exposure
Census who exposes what, and where, to prioritize defensive work across a fleet or a sector.
Subscribe to the data
Start with self-serve search, scale up to streaming and bulk delivery, or talk to us about an enterprise engagement.
Explorer
For individual researchers and small teams.
Professional
Most popularFor security teams running daily operations.
Business
For organizations building on the data.
Enterprise
Custom analytics, residency, and isolation.
Prices in USD. Annual plans are billed yearly. Payments are processed securely by Stripe. By subscribing you agree to our Terms and Privacy Policy.
Questions, answered
If you can't find what you're looking for, get in touch.