Watchlist Risk Scorecard

How it uses the graph

Traverses the threat-intel layer of the graph, in 11 steps:

Why each step runs

1. 01Ranked risk scorecard. Runs whisper.assess once per host (LIST-native, coverage-qualified) and returns a single ranked table — band, label, and the coverage axis that separates listed / known-clean / no-data so unknowns are never treated as clean.
2. 02Coverage roll-up. Counts hosts and risky hosts per coverage bucket (listed / known-clean / no-data) — the portfolio-level summary a watchlist owner reads first.
3. 03Escalation list. Filters to hosts that demand action: scored LOW-or-worse, OR no-data (no coverage — escalate, don't assume clean). This is the actionable subset of the scorecard.
4. 04Top abuse feeds — hostnames. For the hostnames in the portfolio, walks LISTED_IN to FEED_SOURCE (excluding Popularity/Trust feeds via BELONGS_TO category) to name WHICH abuse feeds flagged each host — the evidence behind a 'listed' verdict.
5. 05Top abuse feeds — IPs. For the IPv4 addresses in the portfolio, walks LISTED_IN to FEED_SOURCE (excluding Popularity/Trust) to name the abuse feeds flagging each IP — kept as a separate single-hop arm because a 2-hop pattern under UNWIND returns zero on this engine.
6. 06Precomputed verdict scores & threat classes. Ranks each domain by its stored numeric verdict/threat score and shows exactly which threat classes it triggers (phishing, malware, C2, spam, DGA, botnet, state-actor, OFAC-sanctioned) so a triager sees WHY a host is risky, not just its band.
7. 07Resolving IP, registrar & registrant. Hydrates each domain with its core ownership and addressing context — where it resolves, who registered it, and its registrar — so the watchlist row is more than a bare verdict.
8. 08Hosting ASN & ISP. Follows each domain across the DNS→IP→prefix→ASN path to name the network and ISP hosting it, which reveals shared-hosting clusters and bulletproof providers across a watchlist.
9. 09Nameservers & mail exchangers. Attaches each domain's delegated nameservers and mail exchangers in one pass, exposing shared DNS/mail infrastructure that often links members of a malicious portfolio.
10. 10IP entries → prefix, ASN & ISP. For any raw IP addresses in the pasted list, maps each to its announced prefix, routing ASN, and ISP so IP watchlist entries get the same network context as domains (domains in the list are cleanly ignored here).
11. 11DMARC recipients & DKIM vendor. Surfaces each domain's DMARC aggregate-report recipients and DKIM signing vendor as an email-authentication posture signal; sparse on the current graph and activates as coverage lands.