Neighborhood Threat Scan

How it uses the graph

Traverses the WHOIS, DNS, threat-intel layers of the graph, in 13 steps:

Why each step runs

1. 01Co-tenants on the same IP. Reverse-resolves the seed's address to its co-tenants, the first and cheapest pivot to sibling infrastructure.
2. 02Shared-registrant pivot. Pivots on the registrant email — the highest-signal operator link — to domains the same actor registered.
3. 03Nameservers it uses. Names the DNS operators the seed uses, a delegation pivot that clusters infrastructure under shared providers.
4. 04Unflagged siblings (forward TI). Filters the registrant estate to siblings absent from threat feeds — the not-yet-flagged campaign infrastructure forward TI exists to catch.
5. 05Verdict on a sibling. Lets the analyst pivot any discovered hit through a sourced verdict to confirm and prioritise it.
6. 06Serving IPs & their threat flags. Shows whether any IP address serving the domain is itself flagged malicious (Tor exit, C2, malware).
7. 07Flagged domains sharing the same IP. Flags whether the domain shares an IP with any known-malicious domain — guilt by proximity.
8. 08Per-IP co-tenants & shared/dedicated class. Counts the other hostnames answering from each serving IP and classifies it dedicated, low-density or shared — the call a takedown hinges on.
9. 09Domains co-hosted on this IP (with phishing flags). For an IP indicator, lists every hostname served from it with phishing/threat flags — co-hosting density and whether it mixes phishing with legitimate sites.
10. 10IP network owner & threat status. For an IP indicator, names the announced prefix, ASN and network operator alongside the IP's own threat verdict in one pass.
11. 11Flagged neighbors in the same announced prefix. For an IP indicator, reveals other malicious IPs in the same routed block — a dirty neighborhood signal.
12. 12Prefix threat-listing density. For a prefix indicator, counts how many of its IPs are threat-listed and across how many feeds — how saturated the CIDR block is with abuse.
13. 13Curated abuse / bulletproof signals. Surfaces explicit curated abuse signals such as toxic-neighborhood on the indicator (or its prefix) — the sparse, high-signal bulletproof-hosting marker.