Is this domain or IP actually dangerous?
Investigate one suspicious domain, IP, or network in depth and get back a clear picture of the threat and everything connected to it.
No credit card needed.
What it solves
A quick reputation check tells you a score, not a story. Analysts need to know why an indicator is dangerous, what else it connects to, and where to look next, and building that picture by hand means opening WHOIS, a threat feed, a DNS tool and a BGP looking glass separately for every single pivot.
It reads the indicator through the graph’s threat-scoring engine, checks abuse-feed listings and popularity context, then fans out across resolved hosts, subdomains, prefixes and ASNs in bounded rounds to surface shared infrastructure, MOAS conflicts, clustering by shared IP, name server or registrant, and neighbourhood threat density, before rolling everything into one verdict with the evidence cited.
A full workup on one indicator usually means several separate lookups across as many tools, each pivot copied by hand into the next, before anyone has a full picture.
- a search on each threat feed separately
- a WHOIS tool
- a DNS resolver-history tool
- a BGP looking glass
- a spreadsheet to track the pivots
What this means
- Give it one domain, IP, ASN or prefix and it works outward across its whole footprint: the related domains, the real servers behind any CDN, and the neighbouring infrastructure.
- It returns one coherent verdict crossing the threat-intel, DNS, BGP, WHOIS and historical layers, with the evidence behind it and safe next steps to pivot on.
Dig deeper
Read the how-to
What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.
Open the documentationWhy teams run this
The job this flow does, the failure mode it removes, and the proof it produces.
SOC and threat intelRelated flows
All use casesAttack-Surface Mapper
See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.
Takedown Evidence Package
When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package — the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it — laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.
Indicator Enrichment
Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.
Digital Infrastructure Mapping
Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner — even behind privacy WHOIS and CDNs — via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned.
Network & Routing Report
The full picture of how a network is put together and reaches the internet. Give it a network or address block and get a health card: what it announces, who it peers and buys transit from, whether it leans dangerously on a single upstream, and how well its routes are protected. The one-look report for network engineers assessing reach and resilience.
Typosquat & Brand-Impersonation Scanner
Someone registering a look-alike of your domain usually isn't doing it for fun. This finds the registered impersonations of a brand — across misspellings and risky extensions — checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-alikes into a prioritised list.