Unified search

Search brings hosts, DNS records, certificates and WHOIS into one result list. Enter a domain or IP for a guided interpretation, or use field expressions.

Read the results

The dataset tabs select a type of record; they are not separate searches you need to run manually. Counts may be capped or partial. Each card identifies its dataset, observation date where available, the useful fields and why it matched. Details and Compact change the presentation of the loaded results.

Use the left rail to refine a supported field. The right panel presents observed connections and favicon lookalikes when available. A shared IP, tracking tag or icon is an investigation lead; it does not prove common ownership.

Anonymous visitors receive a limited preview. Hidden facets and cards lead to signup and preserve the current query. WHOIS and some fields still require an eligible paid entitlement after login.

On staging, personal web UI WHOIS also accepts available Free monthly credits. Unified WHOIS uses 1 credit per dataset/page, while granular WHOIS starts at 3 credits; the full cost must be available before data is read. CPE access and API/export/Pivot permissions remain separate. See Credits.

The staging CVE/KEV filters and software explanations associate existing observations with catalogue advisories. They are not active vulnerability checks. See Search and vulnerability associations for accepted selectors, matched products/versions and incomplete-result handling.

Continue an investigation

Open Pivot to follow infrastructure links, or save useful observations as evidence in an investigation. Creating a monitor starts a separate monitoring workflow; reviewing a result does not enable background collection.

For an organization, start Search inside the selected client space or asset scope. Its credit envelope and permissions apply. Personal credits do not pay when the organization budget is exhausted. See Organization workspaces.