Pivots

A pivot takes one identifier - a domain, IP address, email, phone number, @username or URL - runs a lookup on it, and shows you what it leads to: the IPs a domain points at, who owns an IP, the accounts linked to an email. You choose which results to keep, and they are added to the board as nodes, connected to the identifier with a labelled connection.

Pivots don't use the AI. Each one queries a public source directly and gives the same answer every time you run it, fast and at no cost. When you want judgement about what the results mean or where to go next, Ask the agent hands them over.

Running a pivot

1. Right-click a node and choose Pivot…. Any node works: an Identifier, or a note, article, actor or organization that mentions one. Identifier nodes also have a pivot button on the card and in the side panel.
2. The dialog lists the identifiers it found in the node. Pick one, then pick a lookup.
3. Review the results. Facts (registrar, country, line type…) are shown at the top; below them, the results that could become nodes, each with the connection it would get. The likely useful ones are ticked; results already on the board say on board: will link.
4. Add to the board. Everything added - nodes, connections and the saved facts - is a single undo step.

Pivoting on several nodes

Select several nodes and choose Pivot in the selection bar (or right-click one of them: Pivot N selected…). The dialog groups what it found by kind, 3 domains, 2 emails; pick a kind and a lookup and it runs on every one of them. The results come back in two lists:

• Shared: what turned up for more than one of them, most-shared first, with which ones share it. The same registrar, IP, nameserver, mail server or network behind several fronts is how one operator shows up.
• Found for one: everything else, each marked with where it came from.

Shared results are ticked by default. Adding one creates a single node, linked to each input that led to it.

AI pivot

In the Pivot dialog, describe what you want (Who is behind this domain? Follow it two hops, skip Cloudflare.) and choose Pivot with the agent. The assistant receives the node, its identifiers and your goal, and uses the same lookups as the dialog: it runs them, chains onto promising results (at most three hops), and skips dead ends and shared infrastructure unless you asked for them.

When it's done it sends back a proposal, which opens in the Pivot dialog: your goal, its summary, the lookups it ran (open each for its facts), and the results it suggests adding, each with a one-line reason. Everything else the lookups found is listed below, unticked. Nothing is added until you choose Add to the board. Results further down a chain bring the steps that led to them, so a suggested organization arrives with the IP and domain that connect it to your node.

If no AI provider is set up, the request is left in the agent's input for you to send later.

Pictures

Pivot on a media node holding a picture:

• Photo metadata reads the camera, capture time, editing software, author and GPS position from the file. When there is a position, it offers a Location node (taken at), named from the map. The stored copy is read, so the metadata is the original file's; pictures from social platforms usually have it stripped.
• Reverse image search gives Google Lens, TinEye and Bing search links, when the picture has a public address.

The facts are saved on the media node and shown in its side panel.

When you pivot from a node that only mentions the identifier (a note with an email in it), the identifier is added as its own node, linked to the note with mentions, and the results hang off it. Untick the option at the bottom to connect the results to the note directly.

The lookups

Identifier	Pivot	Facts	Can add
Domain	WHOIS	Registrar, registrant (when not redacted), country, created / expires, nameservers, abuse contact	Registrar and registrant as organizations or people, nameservers
Domain	DNS records	SPF and DMARC policies, site-verification TXT records, certificate authorities	IP addresses, mail servers, aliases, nameservers
Domain	Subdomains	Number of host names in certificate logs	Subdomains, with the dates their certificates were issued
Domain, URL	Archive history	First and latest Wayback Machine captures	-
IP address	Owner and network	Owner, network, range, country, ASN, abuse contact, reverse DNS	The owning organization, reverse-DNS names
Email	Email check	Valid, accepts mail, free webmail or own domain, mail servers, Gravatar name, place and job	The email's domain, the Gravatar person, their linked accounts
Phone	Number details	Valid, country, line type, international and E.164 formats, WhatsApp link	-
URL	Site domain	-	The domain the page is on
Username	Account search	Accounts found, sites checked	Profile URLs on the ~480 sites checked (takes up to a minute)
Picture	Photo metadata	Camera, lens, serial, taken, software, author, GPS	A Location node where it was taken
Picture	Reverse image search	Google Lens, TinEye and Bing links	-

Sources: registry RDAP and WHOIS, your system's DNS resolver, crt.sh certificate logs, the regional internet registries and RIPEstat, Gravatar, the Internet Archive, and offline libphonenumber data. None need an account or key.

Why the same node is reused

The board never holds the same identifier twice. Values are compared in canonical form (WWW.Example.com and example.com are the same domain; +44 20 7946 0958 and 0044 20 7946 0958 the same number), and a pivot that finds something already on the board links to that node instead of adding a copy.

That is how shared infrastructure shows up: pivot on four suspect domains and if three of them resolve to the same IP, that IP node ends up with three connections. Organizations and people are matched by name.

Provenance

Everything a pivot adds records where it came from:

• New nodes show Found by DNS records of example.com · DNS (system resolver) · date, with a link to check the answer at the source.
• Connections carry the same in their reasoning, e.g. DNS records of example.com (A record): DNS (system resolver), 2026-09-26.
• Facts are saved on the identifier per lookup, with source and date. Running the same lookup again replaces that lookup's facts; other lookups are kept.

Dossiers include all of it: identifiers list their facts, every pivot-created node has a Found by line, and the source links appear in the numbered source list.

Good to know

• WHOIS registrant details are redacted for most domains since GDPR; the pivot says Redacted rather than adding a privacy service as an organization.
• A matching username on another site is not proof it is the same person. Check each profile.
• crt.sh is a free service and is sometimes overloaded; if Subdomains fails, try again in a minute.
• The assistant runs pivots with its pivot tool, and can put an identifier on the board with create_identifier. Its other lookup tools (whois_lookup, dns_lookup, ip_lookup…) answer questions in the chat without proposing nodes.