Infrastructure Pivot
Open Pivot with a domain, IP address or supported favicon seed. The graph follows observed signals including shared addresses, certificates, favicons, tracking identifiers, WHOIS and technologies.
A link can prefill your input, but it does not start a paid lookup. Check the input and your account or selected organization client, then choose Auto-explore on a personal account. Returning after sign-in or reloading the page also requires this explicit action.
If the page says “This action has changed. Reload the page before trying again.” (HTTP 405), reload it, review the prefilled input and choose Auto-explore only when you want to try again. The failed request is not retried automatically.
On a personal account, Auto-explore is the primary action: 5 credits total for the initial pivot and up to two automatic expansions. It stops earlier when there is no eligible lead, or a time or graph limit is reached. No additional credits are charged. If no step delivers a result, the full reservation is refunded; an early stop after delivery does not prorate the fixed package.
Open Exploration options beside the main button to choose a larger metered budget (up to 100 credits), or a single pivot. Extended exploration keeps the existing per-step prices and refunds its unused budget. The button shows the selected price or budget before you launch it. Continuing a saved pivot skips its initial lookup; the guided package then includes up to two new expansions. Organization workspaces retain their existing separately priced workflow.
The Synthesis view offers two presentations:
- Branches, the default, shows Discovered domains beside the linked stage columns. The catalogue groups observed names under their domain, lists the starting domain's observed subdomains first, and provides local search and pagination. Choose a name to see its connection path; use its eye button to inspect evidence without changing the path. It initially opens a developed observed route instead of stopping at the first direct neighbour. The step navigation scrolls to stages outside the viewport. Inspecting a card keeps the displayed route intact.
- Path shows that same observed chain vertically. Changing a branch explicitly follows its collected downstream connections. Reset path returns to the default route. A previously focused path is not silently restored on a new visit.
The search above the graph finds already collected domains and signals. Selecting, searching, changing tabs or switching presentation makes no lookup and uses no credits. Hiding a node requires opening Visibility options and explicitly choosing the hide action; the restore control brings manually hidden nodes back. The favicon-similarity filter starts at 75%. Names outside that filter are explicitly counted; Show all collected names reveals them without a lookup. Manual hides remain separate.
The Investigation panel separates results from leads and sources. For the current exploration it shows completed expansions, spent/refunded credits and why execution stopped. The graph's connections are not execution-step counters. Older saved graphs can show their expanded points but do not reconstruct missing billing history. New JSON exports include available execution metadata.
The inspector starts with relationship evidence and the observed path. Observed data contains technical observations and source context; detailed metrics remain optional. Subdomains are labelled under their registrable domain. A parent label is a naming hierarchy, not a newly observed asset or proof of ownership. Connections remain attached to exact observed names. Older snapshots without a recorded path are never given an invented link. Full graph retains the spatial layout and its controls.
The public preview masks restricted nodes. Sign in to continue; paid capabilities still follow your plan. Similarity and confidence indicators describe the recorded evidence, not a verified attribution or a vulnerability score.
Your pivots are saved as you explore them: reopen one from My pivots, share it, or undo the last pivot with the undo button next to Saved. Undoing does not refund the credits that pivot cost. For organization work, start from a selected client space so permissions and credits remain attached to the correct organization.
To read confidence, relevance and link scores, see Pivot scores.
Follow the contextual guide
Choose Replay guide above the graph to tour your existing results. The guide covers Branches and Path, the connection-stage buttons, investigation readings, Results and Leads, the evidence inspector, source coverage and the appropriate exploration action for your account. It distinguishes connection stages from executed expansions and explains when credits are spent. It never starts a lookup or changes your exploration budget.
Each step highlights the live control and opens its relevant panel. Use Back, Next, Finish guide or Escape; on small screens the explanation and its target keep separate space. The updated guide is offered once after a completed new search, including to people who saw the older guide. Opening a saved or shared graph does not automatically start the guide or a search. Read-only viewers are not guided towards unavailable expansion actions.
Understand correlation levels
Select a node to inspect the level on each supporting connection. The graph's Correlation levels legend counts the levels present in the displayed graph; a focused connection also includes its level in the label. For a multi-seed result, choose Inspect collected connections to see the per-connection badges.
| Level | How to read it |
|---|---|
| Certain correlation | The collected signal meets an exact-identity rule, such as the same tracking identifier. This is certainty about that correlation, not who owns the assets. |
| Possible correlation | An observed connection that does not meet a stronger supported rule, such as a shared IP, certificate name, WHOIS value, technology or favicon similarity. |
| Probable correlation | A level reserved for corroborated signals. The current engine does not collect the companion attributes required to assign it. |
| Not evaluated | No recognized level was supplied, including older saved results. Do not infer a level from the numeric score. |
Levels describe observed correlations, not ownership, a probability or a confirmed security finding. Numeric connection scores and node confidence still rank the results independently. A high score or several seeds sharing a connection does not turn it into a stronger level.
An exact favicon could qualify for Certain correlation only with a verified complete count of one to five hosts. The current favicon data does not establish that count reliably, so favicon connections remain Possible correlation. A perceptual similarity score of 1 alone is not proof of exact identity or rarity. Shared certificate names are likewise not certificate serial or fingerprint matches.
The badges neither reveal restricted nodes nor change the price of a pivot. Review the supporting observations and make your own assessment before using a connection in a client deliverable.
Compare domain profiles
After exploring a domain, choose Similar profiles to inspect its observed registration and DNS services. Choose a registrant prefix, then compare mail providers, TXT verification services, DNS providers or the web hosting ASN. The candidate set always uses that prefix and the original domain's registrar, with a maximum of 100 candidates. This is not a search across every domain sharing a provider.
The latest available WHOIS must still match the prefix and registrar. By default, candidates must match every selected criterion; the minimum selector can allow partial matches, with at least one technical match beyond the two WHOIS filters. Each result shows matching, different and unknown criteria, along with collection dates. DNS dates refer to the collection month of a merged record, not a fresh check of every field.
A shared provider such as Microsoft mail or Brevo does not identify a common customer account. Similar profiles are research leads, not proof that domains belong to the same company. The comparison itself does not charge credits or change your graph. Explore this candidate starts the usual separately priced pivot from that domain, with the cost displayed before the click.
In synthesis and group details, subdomains appear under their registrable domain. A parent heading is a naming hierarchy, not a newly discovered asset. Registration links show a named organization or the indexed contact value when your account can read WHOIS contacts. A contact match is evidence, not confirmation of ownership. Older saved graphs may contain only a contact hash: Shared WHOIS contact then explains that a new pivot is needed to read the available value. Related organization names are matched on whole words at the same registrar, so a longer unrelated name does not count as the same organization.
Assess affiliation and possible impersonation
Domain details separate relationship evidence from imitation indicators. You can distinguish a registration link, shared infrastructure and copied content. A relationship supported by both a named organization and certificate-name evidence is labelled corroborated, not confirmed ownership. Registrations reached through another domain are not automatically attributed to the original company.
Possible impersonation can be raised without an external phishing report when deceptive spelling (a typo or look-alike characters) also shares favicon or tracker evidence, subject to recorded registration and certificate relationships. Brand presence in a name, title or subdomain, or another country TLD, is not sufficient. A shared analytics identifier is labelled separately. Analytics ID on this site only identifies a tag observed on that site; it does not mean the account is shared with the starting target. Explicit phishing reports remain separately labelled. A common provider, free certificate, working mail service or missing phishing report alone establishes neither ownership nor safety. Open the evidence before drawing a conclusion.
Fresh pivots also include URLsDB provider context for up to 100 collected registrable domains: mail, DNS, TXT provider markers and network. Each observation retains its source and date precision. Unknown, not found, unavailable and not checked states are distinct; older snapshots may not include this context. Common Microsoft, OVH or Brevo markers identify providers, not a common customer account, and do not raise the correlation level. This enriches the existing graph; use Similar profiles for the bounded candidate comparison described above.