ict9.help

This hostname's full card — resolution chain, registration and inbound/outbound links.

MATCH (h:HOSTNAME {name: $host})
OPTIONAL MATCH (h)-[:RESOLVES_TO]->(ip:IPV4)-[:ANNOUNCED_BY]->(ap:ANNOUNCED_PREFIX)
OPTIONAL MATCH (a:ASN)-[:ROUTES]->(ap)
OPTIONAL MATCH (a)-[:HAS_NAME]->(an:ASN_NAME)
OPTIONAL MATCH (ip)-[:LOCATED_IN]->(city:CITY)
OPTIONAL MATCH (ip)-[:HAS_COUNTRY]->(ipc:COUNTRY)
WITH h, ip, ap, a, an, city, ipc
LIMIT 20
WITH h,
     collect({ip: ip.name, prefix: ap.name, asn: a.name, network: an.name, city: city.name, country: ipc.name}) AS resolutions,
     collect(a.name) AS asnNames,
     collect(ap.name) AS prefixNames,
     collect(ap.isMoas) AS moasFlags,
     collect(ap.rpkiStatus) AS rpkiStatuses,
     head(collect(a)) AS primaryAsn,
     head(collect(ap)) AS primaryPrefix
OPTIONAL MATCH (primaryPrefix)-[:CONFLICTS_WITH]->(conflict:ASN)
WITH h, resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, primaryAsn,
     collect(conflict.name) AS conflictAsns
OPTIONAL MATCH (h)-[:HAS_REGISTRAR]->(reg:REGISTRAR)
OPTIONAL MATCH (h)-[:REGISTERED_BY]->(org:ORGANIZATION)
OPTIONAL MATCH (h)-[:CHILD_OF]->(tld:TLD)
WITH h, resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, primaryAsn, conflictAsns,
     collect(reg.name) AS registrars,
     collect(org.name) AS organizations,
     collect(tld.name) AS tlds
OPTIONAL MATCH (h)-[:HAS_EMAIL]->(em:EMAIL)
WITH h, resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, primaryAsn, conflictAsns,
     registrars, organizations, tlds,
     collect(em.name) AS emails
OPTIONAL MATCH (h)-[:HAS_PHONE]->(ph:PHONE)
WITH h, resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, primaryAsn, conflictAsns,
     registrars, organizations, tlds, emails,
     count(ph) AS phoneCount
OPTIONAL MATCH (h)<-[:MAIL_FOR]-(mx:HOSTNAME)
WITH h, resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, primaryAsn, conflictAsns,
     registrars, organizations, tlds, emails, phoneCount,
     collect(mx.name)[0..20] AS mxHosts
OPTIONAL MATCH (h)<-[:NAMESERVER_FOR]-(ns:HOSTNAME)
WITH h, resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, primaryAsn, conflictAsns,
     registrars, organizations, tlds, emails, phoneCount, mxHosts,
     collect(ns.name) AS nameservers
OPTIONAL MATCH (h)-[spf:SPF_A|SPF_EXISTS|SPF_INCLUDE|SPF_IP|SPF_MX|SPF_REDIRECT]->(spfTarget)
WITH h, resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, primaryAsn, conflictAsns,
     registrars, organizations, tlds, emails, phoneCount, mxHosts, nameservers,
     collect({mechanism: type(spf), target: spfTarget.name})[0..50] AS spf
CALL { WITH primaryAsn MATCH (primaryAsn)-[:BGP_NEIGHBOR]-(peer:ASN) RETURN count(peer) AS asnPeerCount }
RETURN h.name AS name,
       h.rank AS rank,
       h.verdictLevel AS verdictLevel,
       h.verdictScore AS verdictScore,
       h.verdictBlocking AS verdictBlocking,
       h.verdictCoverage AS verdictCoverage,
       h.verdictAdvisory AS verdictAdvisory,
       h.threatSources AS threatSources,
       h.threatFirstSeen AS threatFirstSeen,
       h.threatLastSeen AS threatLastSeen,
       h.isTor AS isTor,
       h.isVpn AS isVpn,
       h.isProxy AS isProxy,
       h.isC2 AS isC2,
       h.isPhishing AS isPhishing,
       resolutions, asnNames, prefixNames, moasFlags, rpkiStatuses, conflictAsns,
       registrars, organizations, tlds, emails, phoneCount, mxHosts, nameservers, spf,
       asnPeerCount

The observed subdomain count, to depth 3.

MATCH (h:HOSTNAME {name: $host})
CALL { WITH h MATCH (h)<-[:CHILD_OF*1..3]-(sub:HOSTNAME) RETURN count(sub) AS subdomainCount }
RETURN subdomainCount