Pivot search
Start from one shared attribute — an IP, a domain, or a nameserver — and find every report that touches the same infrastructure. A pivot is a lead, not a verdict.
Pivot attributes
Find all reports whose enriched DNS or hosting data contains the given IP. Reveals co-hosted phishing infrastructure.
Find reports targeting the same domain or subdomains. Clusters related phishing campaigns.
Find reports whose domains share a nameserver. Identifies attacker DNS infrastructure patterns.
A pivot is a lead. Hosts and domains it surfaces have their own verdicts — some are clean shared-hosting neighbours. Block on the verdict, not the relationship.
Run a pivot to see related reports here.
Pick an attribute above and enter a value to search.
Run it headless
GET /api/v1/public/pivot?type=ip&value=185.234.72.19&limit=50Results are limited to 50 per query. API documentation →