Infrastructure Pivot
Open Pivot with a domain, IP address or supported favicon seed. The graph follows observed signals including shared addresses, certificates, favicons, tracking identifiers, WHOIS and technologies.
A link can prefill your input, but it does not start a paid lookup. Check the input and your account or selected organization client, then choose Explore. Returning after sign-in or reloading the page also requires this explicit action.
If the page says “This action has changed. Reload the page before trying again.” (HTTP 405), reload it, review the prefilled input and choose Explore only when you want to try again. The failed request is not retried automatically.
Select a node to inspect its supporting connections, then choose Pivot from here or an asset lookup. Zoom, fit the graph and hide a noisy signal using the graph controls. A new pivot can require another search; review the displayed cost or limit.
The public preview masks restricted nodes. Sign in to continue; paid capabilities still follow your plan. Similarity and confidence indicators describe the recorded evidence, not a verified attribution or a vulnerability score.
For a saved graph with notes and evidence, use Investigations. For organization work, start from a selected client space so permissions and credits remain attached to the correct organization.
Understand correlation levels
Select a node to inspect the level on each supporting connection. The graph's Correlation levels legend counts the levels present in the displayed graph; a focused connection also includes its level in the label. For a multi-seed result, choose Inspect collected connections to see the per-connection badges.
| Level | How to read it |
|---|---|
| Certain correlation | The collected signal meets an exact-identity rule, such as the same tracking identifier. This is certainty about that correlation, not who owns the assets. |
| Possible correlation | An observed connection that does not meet a stronger supported rule, such as a shared IP, certificate name, WHOIS value, technology or favicon similarity. |
| Probable correlation | A level reserved for corroborated signals. The current engine does not collect the companion attributes required to assign it. |
| Not evaluated | No recognized level was supplied, including older saved results. Do not infer a level from the numeric score. |
Levels describe observed correlations, not ownership, a probability or a confirmed security finding. Numeric connection scores and node confidence still rank the results independently. A high score or several seeds sharing a connection does not turn it into a stronger level.
An exact favicon could qualify for Certain correlation only with a verified complete count of one to five hosts. The current favicon data does not establish that count reliably, so favicon connections remain Possible correlation. A perceptual similarity score of 1 alone is not proof of exact identity or rarity. Shared certificate names are likewise not certificate serial or fingerprint matches.
The badges neither reveal restricted nodes nor change the price of a pivot. Review the supporting observations and make your own assessment before using a connection in a client deliverable.