Infrastructure Pivot
Pivot from a seed to its correlated infrastructure
Try an example
Infrastructure pivoting & OSINT attribution
Infrastructure pivoting is an OSINT and threat-intelligence technique for expanding a single indicator — a domain, IP address, favicon hash, or tracker — into the wider network of assets run by the same operator. Instead of investigating one host in isolation, you follow the artefacts that infrastructure shares, surfacing sibling domains, staging hosts, and command-and -control panels that a flat DNS or WHOIS lookup would never connect.
The Profundis Pivot correlates six independent signal families across the entire index: shared trackers (analytics and tag-manager IDs), reused favicon hashes, TLS certificate SANs, passive-DNS co-resolutions, WHOIS registrant and nameserver overlap, and technology-stack fingerprints. Every edge in the resulting graph is labelled with the signal and the exact shared value that links two nodes, so each correlation stays explainable and auditable — not a black-box score.
Frequently asked questions
What is infrastructure pivoting?
Infrastructure pivoting is an OSINT and threat-intelligence technique that starts from a single known indicator — a domain, IP address, favicon hash, or tracking code — and expands outward to discover other infrastructure controlled by the same operator. Instead of looking at one asset in isolation, you follow shared signals (identical favicons, reused TLS certificates, passive DNS resolutions, WHOIS registrant details, analytics trackers) to reveal the full network of related hosts, which is essential for attributing and mapping threat-actor and phishing campaigns.
How does the Profundis Pivot tool work?
Enter a seed value (a domain, IP, favicon hash, or tracker) and Profundis expands it into an interactive correlation graph. Each node is a piece of related infrastructure and each edge explains why two nodes are linked — a shared favicon, a common certificate SAN, a passive-DNS resolution, a WHOIS match, or a shared tracker. Signals are correlated across the entire Profundis index, so a single seed can surface infrastructure that is otherwise hard to connect.
What signals does the Pivot tool correlate?
The Pivot tool correlates six families of signals: shared trackers (analytics and tag-manager IDs), favicon hashes (visually identical or reused icons), TLS certificate SANs (domains sharing a certificate), passive DNS (hostnames that resolved to the same IPs), WHOIS data (common registrant/organization/nameserver), and technology stack fingerprints. Combining these signals reveals infrastructure relationships that DNS or WHOIS data alone would miss.
Is the Infrastructure Pivot tool free?
Yes — Profundis offers a free tier. Anonymous and free-tier users get a shareable teaser graph of the correlated infrastructure, and paid plans (starting at €99/month) unlock the full live pivot graph, deeper expansion, and higher quotas. Any pivot can be shared via a permalink so teammates can open the same correlation graph.