Attack Path & Connection Finder

How it uses the graph

Traverses the DNS, WHOIS, TLS, BGP, threat-intel layers of the graph, in 11 steps:

Why each step runs

1. 01Asset verdict. Establishes whether the starting asset is already known-bad, the baseline the path analysis builds on.
2. 02Asset class. Reads host-class so a shared cloud platform reads as structure, not as a misleading attacker link.
3. 03DNS choke point. Finds the foothold's DNS dependencies and ranks them by dependent count — the busiest nameserver is the highest-leverage choke point.
4. 04Registrant estate. Sizes the registrant estate, a persistent ownership pivot that clusters the foothold's infrastructure even after IPs rotate.
5. 05Shared TLS fingerprint. Pivots on JA3/JARM via EMITS_TLS_FINGERPRINT to find servers running the same stack — a clustering link when nothing else connects them.
6. 06Hidden link to the second asset. Checks whether the foothold is provably bridged to a second asset through shared infrastructure — a real link, not guilt by association.
7. 07Foothold IPs. Pins the addresses the foothold serves from, the anchor the co-tenancy, network-reach and danger rings expand from.
8. 08Direct radius — co-tenants. Reverse-resolves each IP to its co-tenants — the infrastructure directly adjacent to the foothold, the direct blast radius.
9. 09Network reach. Traces the IPs to their ASNs, peer counts and datacenters, mapping how far the foothold's network presence reaches.
10. 10Proximity to known-bad. Measures how many known-bad domains already sit on the foothold's own addresses — the distance to danger, not mere association.
11. 11Shortest path between the two assets. Shows the fewest-hop chain of shared infrastructure that provably links the foothold to the second asset, and the exact edge types along it.