ThreatWave has created a powerful query tool to feed off our global honeypot to access historic email data. Query based on specific URLs, Attachments, IPs, Domains, Senders, Message Content, Brands and Keywords. Get message context and history. Assess reputation with history, target insight and message payload to understand context and past behaviors.  Query via REST API.

• Track a sender to see content trends over time
• A suspicious IP is seen on a network, it is queried to find additional associations such as botnets, attachments, URLs, spam, sender
• An unknown hash is looked up to find additional associations such as botnets, URLs, spam, sender

Query based on any email component, some of the most popular are:

• Brand or keyword
• IP
• Domain
• Sender
• Hash
• URL

Platform connectors enable results to flow easily to your system.