Infrastructure Pivot
Open Pivot with a domain, IP address or supported favicon seed. The graph follows observed signals including shared addresses, certificates, favicons, tracking identifiers, WHOIS and technologies.
A link can prefill your input, but it does not start a paid lookup. Check the input and your account or selected organization client, then choose Explore. Returning after sign-in or reloading the page also requires this explicit action.
If the page says “This action has changed. Reload the page before trying again.” (HTTP 405), reload it, review the prefilled input and choose Explore only when you want to try again. The failed request is not retried automatically.
Select a node to inspect its supporting connections, then choose Pivot from here or an asset lookup. Zoom, fit the graph and hide a noisy signal using the graph controls. A new pivot can require another search; review the displayed cost or limit.
The public preview masks restricted nodes. Sign in to continue; paid capabilities still follow your plan. Similarity and confidence indicators describe the recorded evidence, not a verified attribution or a vulnerability score.
Your pivots are saved as you explore them: reopen one from My pivots, share it, or undo the last pivot with the undo button next to Saved. Undoing does not refund the credits that pivot cost. For organization work, start from a selected client space so permissions and credits remain attached to the correct organization.
To read confidence, relevance and link scores, see Pivot scores.
Understand correlation levels
Select a node to inspect the level on each supporting connection. The graph's Correlation levels legend counts the levels present in the displayed graph; a focused connection also includes its level in the label. For a multi-seed result, choose Inspect collected connections to see the per-connection badges.
| Level | How to read it |
|---|---|
| Certain correlation | The collected signal meets an exact-identity rule, such as the same tracking identifier. This is certainty about that correlation, not who owns the assets. |
| Possible correlation | An observed connection that does not meet a stronger supported rule, such as a shared IP, certificate name, WHOIS value, technology or favicon similarity. |
| Probable correlation | A level reserved for corroborated signals. The current engine does not collect the companion attributes required to assign it. |
| Not evaluated | No recognized level was supplied, including older saved results. Do not infer a level from the numeric score. |
Levels describe observed correlations, not ownership, a probability or a confirmed security finding. Numeric connection scores and node confidence still rank the results independently. A high score or several seeds sharing a connection does not turn it into a stronger level.
An exact favicon could qualify for Certain correlation only with a verified complete count of one to five hosts. The current favicon data does not establish that count reliably, so favicon connections remain Possible correlation. A perceptual similarity score of 1 alone is not proof of exact identity or rarity. Shared certificate names are likewise not certificate serial or fingerprint matches.
The badges neither reveal restricted nodes nor change the price of a pivot. Review the supporting observations and make your own assessment before using a connection in a client deliverable.