Skip to content

Relational Intelligence

Sibling-domain overlap, shared infrastructure, and campaign inference across an asset's neighbors. Each signal fires with the linked asset and the relationship reason that surfaced it.

See 7 Relational Intelligence signalsSee verdicts firing these
  • 7 named signals across 3 subgroups
  • Recomputed live per IOC, not pulled from a static feed
  • Every signal ships with evidence + 3-question Q&A trail
About

What Relational Intelligence models

Maps an IOC's neighborhood: sibling-domain overlap, shared infrastructure, and inferred campaign relationships.

What it models
Maps an IOC's neighborhood: sibling-domain overlap, shared infrastructure, and inferred campaign relationships.
How it fires
Each signal fires with the linked asset and the relationship reason (shared A-record, certificate SAN overlap, registrant pivot) that surfaced it.
Why it matters
Turns one IOC into a cluster; analysts pivot from a single domain into the operator's full infrastructure in one query.
Subgroups

3 subgroups · 7 signals in Relational Intelligence

Each subgroup bundles signals that share a mechanism: same evidence shape, same direction logic. Tap one to inspect its signal names; every name opens a leaf page with the underlying Q&A trail.

See subgroup detail
See subgroup detail
See subgroup detail
Verdict scenarios

How Relational Intelligence shapes the call

Three real-world situations where this group's evidence dominates the decision. The verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A new domain sharing IP infrastructure, registrar, and TLS certificate fingerprints with a campaign cluster previously linked to credential-theft activity.

VerdictIQ explains

“Decline this domain. The relational graph places it inside an active malicious campaign: shared infrastructure, shared issuance patterns, and shared registrant footprints. Treat as part of the parent operation.”

Medium riskVERDICT · REVIEW
The situation

A domain with two sibling assets that triggered analyst review last month, but no direct shared infrastructure or campaign markers.

VerdictIQ explains

“Send to analyst review. The neighborhood is suspicious but the link is weak; proximity without shared operator evidence. Pull the sibling cases before deciding.”

Low riskVERDICT · ALLOW
The situation

A domain with shared infrastructure consisting only of major cloud and CDN endpoints, no overlap with flagged campaigns, and no operator-level co-location.

VerdictIQ explains

“Allow. Shared-infrastructure signals here are noise from common cloud tenancy, not operator co-location. No relational reason to delay.”

See full Verdict Gallery

See Relational Intelligence signals fire on your data

Free tier: 100 IOCs/day, LLM layer included.

Start FreeOpen API reference