Glossary
What Is Infrastructure Pivoting?
Infrastructure pivoting is moving from one known indicator — a domain, IP, or certificate — to related infrastructure by following shared attributes: the same IP (co-hosting), the same WHOIS registrant, shared nameservers, or a shared TLS fingerprint. Each shared attribute is a pivot, and chaining pivots expands a single lead into a whole campaign.
How Whisper models it
Every pivot is an edge: a shared IPV4, NAMESERVER_FOR, or HAS_EMAIL link expands one node into its neighbours.
MATCH (h:HOSTNAME {name:"bodis.com"})-[:HAS_EMAIL]->(e:EMAIL)<-[:HAS_EMAIL]-(o:HOSTNAME) RETURN o.name LIMIT 10Pivots are relationships
Every investigation is a series of pivots: this domain resolves to that IP; that IP also hosts these other domains; those domains share a registrant email; that registrant registered a dozen more. Each step follows a shared attribute from one node to its neighbours. The attributes that make good pivots are the ones an operator reuses — hosting, registrant, nameservers, certificates.
The common pivots
Co-hosting (other domains on the same IP), shared registrant (other domains with the same WHOIS contact), shared nameservers (a small DNS provider an operator favours), shared TLS or JARM fingerprints (the same server software and config), and the same BGP prefix or ASN (the same bulletproof host). A weak pivot widens the net; a strong one — a rare shared certificate or a niche registrant — clusters tightly.
One query instead of ten tools
Done by hand, each pivot is another tool and another tab. In a pre-joined graph each is a single edge, so the chain — indicator to its neighbours to theirs — is one traversal. That is what turns a day of manual pivoting into a single question.
See it in practice
Run it live in these use cases: Trace the external attack path, Map adversary infrastructure.
Where this shows up
See it in a live investigation: Map adversary infrastructure.
Go hands-on with the threat-intel recipes.
Workflows that use this
Runnable workflows where this concept does the work.