Takedown Evidence Package
When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package — the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it — laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.
How it uses the graph
Traverses the threat-intel, DNS, WHOIS layers of the graph, in 7 steps:
How it walks the graph7 steps
01Threat verdict
Scoring the domain with explain()…
threat-intelDNSWHOIS
02Threat-feed listings
Listing the threat feeds that name it…
threat-intelDNSWHOIS
03WHOIS owner, registrar & contact
Reading the WHOIS registrar and registrant…
threat-intelDNSWHOIS
04Registration age (NRD signal)
Pulling registration history for the NRD signal…
threat-intelDNSWHOIS
05Resolving IPs + network owner
Resolving IPs and naming the hosting network…
threat-intelDNSWHOIS
06Co-hosted domains (the wider campaign)
Finding domains sharing its IP…
threat-intelDNSWHOIS
07Registered look-alikes
Generating registered look-alike domains…
threat-intelDNSWHOIS
Why each step runs
- 01Threat verdict. Opens the dossier with the authoritative sourced verdict that justifies pursuing a takedown at all.
- 02Threat-feed listings. Cites the specific LISTED_IN feeds (minus popularity lists) plus the score and level — third-party corroboration a registrar/host will accept.
- 03WHOIS owner, registrar & contact. Names the registrar and registrant organisation — the accountable parties and the addressees of an abuse complaint.
- 04Registration age (NRD signal). Surfaces creation date via whisper.history; a newly-registered domain is a strong abuse indicator that strengthens the case.
- 05Resolving IPs + network owner. Maps the domain to its IP, prefix and named ASN, identifying the host that abuse contact must also reach.
- 06Co-hosted domains (the wider campaign). Reverse-resolves the IP to surface co-hosted siblings — the wider campaign that should be taken down alongside the seed.
- 07Registered look-alikes. Lists existing brand variants so related squats are bundled into the same takedown rather than left to resurface.