Atlas investigations

An Atlas investigation maps the infrastructure behind one indicator. It pivots across Atlas, Have I Been Squatted’s store of domain observations, judges each domain it finds, and keeps watching what it found until its end time, even while nobody is at the dashboard. The result is a map of domains and the values that link them, such as addresses, certificates, favicons and tracking identifiers.

Start an investigation

Open Atlas from the Detection section of the sidebar.
In the search box, enter an indicator or describe what to find, in up to 250 characters.
Optionally, choose when it ends with Runs in the search box. It ends an hour after it starts unless you pick a length or a date, at most 30 days away.
Press Enter. The investigation opens on its map.

An indicator can be a domain, an IPv4 address, a nameserver or mail server, a favicon hash, a TLS certificate hash, an origin certificate fingerprint, an identifier such as a Google Tag Manager container, a redirect host or an HTTP banner. Have I Been Squatted detects the kind from what you type.

A request such as “new lookalikes of example.com with a login form” starts with an empty map. Its first steps search Atlas for observed domains whose names match what the request describes, such as each brand’s name for lookalikes of several brands. They search certificate transparency for names Atlas has not observed yet, then profile and pivot from what they found.

The Investigations tab lists the organization’s investigations with their status.

How an investigation runs

An investigation works in steps, about one a minute while it has leads to follow.

Profiles and pivots. A step profiles domains from Atlas and pivots on values: it lists the other domains that share an address, a certificate or an identifier. It can also search Atlas by domain name, search certificate transparency and run a live scan of a domain, up to four scans an hour. A step makes at most 12 calls.
Name searches. A name search lists the domains Atlas observed whose name matches a pattern, from the newest observations, the most likely phishing first. It reads up to 1,000 matching observations, so a broad name such as a large brand’s covers only its newest days.
Verdicts. The investigation judges each domain it profiles as malicious, suspicious, unknown or benign, with a reason that names the evidence: the shared value, the phishing score, the registration or the page.
Strong and common links. A value few domains share, such as a favicon, a certificate or a tag manager identifier, suggests one operator. A value seen on more than 2,000 observations, such as a content delivery network address or a popular nameserver, links nothing. The investigation marks it too common to follow and does not pivot on it by itself.
Running. Once no lead is left, or after 24 steps in a UTC day, the investigation keeps running between steps. Every six hours it runs its name searches again and re-checks the rarest values it followed. A new domain from either starts a step to judge it.
End time. At its end time the investigation stops running and keeps its map, findings and log.

Atlas observations from the last 30 days feed each pivot. An investigation holds up to 2,500 domains and 5,000 values, and an organization runs up to five investigations at once.

Status

Status	Meaning
Investigating	Following leads, about one step a minute.
Running	Nothing left to follow. It runs its searches and re-checks its rarest values every six hours.
Paused	An admin paused it. Resume carries on.
Stopped	An admin stopped it. Resume does not restart it; a request from + on a card runs it again.
Blocked	It waits until a member opens it.
Ended	Its end time passed. Its map stays; Run again sets a new end time and runs it again.

An investigation runs with the access of the member who last opened it, for 14 days. Opening it renews that access. When the access lapses, or the member leaves the organization, the investigation is blocked until someone opens it. An investigation and its log are kept for 90 days after its last change.

Read the map

The map has a card for each domain, each value and each name search. A domain card shows its verdict, the reason and its phishing score. A value card shows how many domains share it in Atlas, and a name search card how many domains matched. The map flows down from the entry: each row holds the cards found through the row above it, in that row’s order, and lines run from a card down to the cards found through it.

Lanes. When the domains form more than one cluster, the map draws each cluster as a lane, side by side, the most severe first, so their entries line up across the top. A cluster is the cards joined by values that are not too common to follow. A cluster holding a name search is named for its pattern. A common value sits in the lane of the card it was found through, and its lines to other lanes are not drawn. A domain that shares nothing joins the lane of its parent domain. The rest go to a last lane, “Nothing to pivot on yet”, stacked by verdict, with malicious and suspicious domains left in view.
Folded lanes. Each lane starts folded to its first row, with a last line saying what the rest holds, such as “Show 3 domains and 11 values”. Select that line or the lane’s header to unfold the lane and move the map to it, and the header again to fold it.
Severity buckets. Lanes sit under a heading for their worst verdict: malicious, suspicious, unknown, benign or not judged, with “Nothing to pivot on yet” last. Malicious and suspicious buckets start open, and so does the most severe bucket there is; the rest start closed as one card. Select a heading or a closed bucket’s card to open or close it.
Stacks. Two or more cards of one kind found through the same card are drawn as one stack, such as “8 IPv4 addresses”. Values only one domain on the map has link nothing, so two or more of one kind in a row of a lane stack together, marked “One domain each”. Select a stack to show its cards, and Collapse to fold them again. Unstack all beside the zoom buttons opens every bucket, lane and stack, and Stack all puts the map back as it started.
Open cards. Select a card to open it in place. It lists the cards it was found through and every card it connects to; select one to move the map there. While a card is open, the routes back to the entry stand out and other cards dim. Details on a domain card opens the lookup result for that domain.
Running steps. While a step runs, dashed cards show where its results will land, and the card a call works from says what is running on it.
Replay. The bar under the map draws each step as a bar: its height is how much the step found, and its color is the worst verdict among what it found. Select a bar to see the map as it stood after that step, or play the steps in order.
Views. The layers button beside full screen switches the view: Tree, the map described here, Table, Clusters, Flows, Scatter, Calendar or Breakdown. Table lists the map’s domains instead. Each row shows the domain’s verdict and phishing score, what it was found through, how many of its values another domain shares, and the step that found it. It also shows the registrar, registration date, network, country, HTTP status and page title from the domain’s newest Atlas observations in the last 30 days. Sort any column, filter by text or verdict, and select a domain to open its lookup result. The table follows the replay.
Clusters. Shows the map’s domains as a tilted contour map of solid hills. Each hill is a cluster: domains that share a value, or three or more domains whose names start with the same stem. Values that mostly the same domains carry make one cluster, and up to ten clusters show, the strongest first: a value counts for more when fewer domains in Atlas carry it, and favicons, tracking identifiers, certificates and redirects count for more than hosting. Common values never form a cluster. A hill is drawn as stacked terraces, darker at its base and lighter toward its summit, and rises higher the more domains it holds and the more and rarer values they share, with the number of domains marked over its summit. Its color follows the verdict most of its judged domains hold: red for malicious, orange for suspicious and gray otherwise. Each domain is a dot on the hills of exactly the clusters it belongs to. A nearer hill hides what stands behind it, and the sidebar still lists every domain in a cluster. Drag to move around the map, and scroll, pinch or use the zoom buttons to zoom. Zoomed in, each hill names its domains ring by ring around its summit, a whole ring at once when every name in it has room, and closer still shows cards with each domain’s verdict, reason and phishing score by the same rule. A name never covers another dot or name. Domains in no cluster sit in their own container in front of the hills, laid out so all their names show together as soon as names show. Point at a hill to see what it is clustered on and how its domains were judged. Point at a domain to see its verdict and phishing score, its screenshot when the investigation looked it up, and its registrar, registration date, network, country, HTTP status and page title from Atlas. Select a hill to zoom to it and list its domains, select a domain to open its lookup result, and press Escape or All clusters to zoom back out. The view follows the replay.
Flows. Shows the investigation’s pivot points as a Sankey diagram: bands run from each kind of value to the value and on to the domains’ verdicts, so you can see which shared values tie domains together and how those domains were judged. Only values two or more domains share are drawn. The strongest show by name, weighed as in Clusters, and the rest of each kind fold into one node, such as “27 more IPv4 addresses”. A band is as wide as the links it carries, one for each value a domain shares, so a domain sharing three values counts three times. Atlas column adds each domain’s registrar or network from its newest Atlas observations between the values and the verdicts. Common values and name searches tie domains to one operator only weakly, so they are left out until you turn them on from Also show; they then show dimmed, with common values folded into one node per kind. Point at a band or node, or move to it with the arrow keys, to read what it shows, such as how many of the domains sharing a favicon are malicious, and to trace its links through every column. Select one, or press Enter, to list its domains with their verdict, phishing score, registrar, registration date, network, country and page title, select a domain to open its lookup result, and press Escape to close the list.
Scatter. Plots each domain by its registration date from Atlas against its phishing score. A bubble is larger the more of its values another domain shares, and its color is the domain’s verdict. A domain without a registration date or a phishing score has no place on the plot, and the view says how many are left out. Turn on Density contours to shade where the domains concentrate under the bubbles. Point at a bubble to see the domain, its verdict, phishing score, registrar and registration date, and select it to open its lookup result. The view follows the replay.
Calendar. Shows the days the domains were registered as a calendar, weeks across and weekdays down, by UTC day. It covers the weeks from the first registration to the newest, at most the newest 52 weeks, and says how many domains have no registration date or were registered before its first week. A day’s shade counts the domains registered on it; choose Malicious or suspicious share from Shade to shade each day by the share of its domains judged malicious or suspicious instead. Point at a day to see its date and how many domains were registered on it. Select a day to list its domains, select a domain to open its lookup result, and press Escape to close the list. The view follows the replay.
Breakdown. Shows where the domains sit as a Marimekko chart: a column for each registrar, as wide as its domains, split by verdict with the worst at the bottom. Choose Network or Country from Columns to group the domains by those instead. Registrar, network and country come from the domains’ newest Atlas observations, as in Table. Up to eight of the largest show by name, each with at least 4% of the domains, and the rest fold into one Other column, so every name has room. Domains with no registrar, network or country take a column of their own. Point at a cell to see its column, verdict and how many domains it holds. Select a cell to list its domains, select a domain to open its lookup result, and press Escape to close the list. The view follows the replay.

Use the map’s buttons to zoom, fit the map and show it full screen. The Activity tab lists the investigation’s log, newest first, with each call and its outcome.

The page’s address keeps what it shows: the view, the replay step, the open card, the selected hill, flow, day or cell, the table’s filter, sort and page, what a chart is set to show, an open lookup result, and where the map or the contour map looks. Copy the address to share exactly that view with another member of the organization.

Steer an investigation

Admins can steer an investigation from its page.

The pause button in the page header pauses or resumes the investigation, after asking.
Change end time in the page header moves the end time, earlier or later. Once the investigation has ended, Run again sets a new end time and runs it again.
Select + on a card to extend the investigation from it. Under Signals, choose up to three values from the map, join them with and or or, and narrow the domains with Add filter: phishing, parked or legitimate score, registration age, TLD, registrar, network, country or HTTP status. Set Seen in the last and Up to for the pivot. Under Prompt, tell the investigation what to look for instead. A name search card offers only Prompt: a running investigation runs the search again, and it cannot be pivoted on.
The ⋯ menu on the same panel refreshes a domain from Atlas or runs a live scan.
The archive button on an investigation’s row in All investigations archives it, after asking. Archiving stops the investigation and takes it out of the list. Its map, findings and log stay, and its link still opens it. A request from + on a card, or Run again once it has ended, runs it again and brings it back to the list.

Requests run before the next step, which then judges what they found. An investigation holds up to ten waiting requests. A value too common to follow needs a phishing score, registration, TLD or registrar filter before it can be pivoted on.

Export an investigation

Open the Export menu in the page header.

Findings (IOCs) downloads the malicious and suspicious domains and the values that tie them together as STIX 2.1, CSV or JSON. Values shared by more than 25 domains are left out, and so are the organization’s monitored domains. STIX bundles carry the TLP:AMBER marking.
Investigation downloads a Report (HTML): a page with the findings, the map and the domains lane by lane, which runs no script and loads nothing. Map (SVG) downloads the map as an image, and Report (Markdown) and Map (Mermaid) download text versions.

Ask the Assistant about an investigation

On an investigation’s page, select Assistant in the header and ask what the investigation found, how two domains connect or why a domain was flagged. The Assistant reads the investigation: its status, clusters, flagged domains with their reasons, open leads and recent steps. It explains the map in the same terms as this page.

Ask the Assistant to list the organization’s investigations from any page, or from the Slack app. The Assistant only reads investigations: pausing, steering and changing the end time stay on the investigation’s page.