Pivots and lookups

A pivot takes something you already know — a domain, a URL, an e-mail address — and looks for it somewhere else. OBSCURIQ prepares the links and lookups; you decide which one to open. Nothing runs on its own.

1. Paste a value

Open the Pivots tab (or press 3). Paste a value into Value to pivot on, for example example.com. Below the field OBSCURIQ says what it recognized — Recognized as: Domain. URLs, domains, e-mail addresses, IPv4 addresses, hashes, Bitcoin and Ethereum identifiers are recognized; anything else is searched as a phrase. Defanged values such as hxxps://example[.]com are restored automatically.

You can also start from the log: the magnifier button of an entry (Pivot on “…”) or More actions → Pivot on this value copies its value into the pivot desk.

2. Open a link

The card Open in a new tab groups the links:

• Web search — Google, Bing and DuckDuckGo with the value in quotes, and for a domain Pages on this site (Google).
• Archives — the Internet Archive’s Wayback Machine for a URL or a whole domain.
• Registration data — ICANN Lookup for the domain’s registration record.
• Blockchain explorers — for crypto identifiers (see the tutorial on crypto leads).

Each link opens in a new tab and sends the value to that provider; its terms and privacy policy apply. When you open a link, OBSCURIQ records an Opened pivot entry in the research log with the provider, the link and the time — useful when you later need to show how you found something. Switch this off under File → Workspace settings… if you prefer.

3. Run a lookup

The card Lookups with usefulweb.site tools offers the site tools that fit the value. For a domain:

• Domain history — registration (RDAP), DNS, hosting networks, certificates and Wayback captures.
• DNS and certificate — DNS records, e-mail security records and the live TLS certificate.
• Certificate transparency — every logged certificate with issuers and subdomains.
• Scam signals and Look-alike characters.

For a URL there is also Archive changes; for a 0x transaction hash Decode Ethereum transaction. Under every button OBSCURIQ says who receives the value — for example that DNS and certificate connects to the domain’s web server to read its certificate. Press Run lookup. The result shows a summary, key figures and tables; Show all … rows expands long tables.

Public sources can be slow or rate-limited. If the tool API is busy, OBSCURIQ waits and shows Waiting for the tool API rate limit: … s.

4. Record the result

Press Add result to the log to keep the summary and key figures as a note tagged #lookup. Open the tool page to run it with more options opens the full tool.

5. Record the value itself

The card Record in the case adds the value as an indicator, a source (for URLs) or a note — the entry dialog opens pre-filled so you can add context first. If the value is already in the log, OBSCURIQ tells you.

6. Prepare searches and clean links

At the bottom of the desk, the Search query builder turns a phrase into exact-phrase, PDF and site: queries, and the URL tracking cleaner removes utm_*, fbclid, gclid and similar parameters before you record or open a link. Keep the original link as evidence; the cleaned link is a copy.

Next: Indicators and safe sharing.