One indicator in, the whole operation out
Abuse investigations start with one thing: an IP in a Received line, a domain in a link, a nameserver. Pivot looks it up live and offers every way out of it. Each link on the board says where it came from (DNS, RDAP, the RIR databases, RIPE RIS routing data, certificate logs, Mailwel's own index) and when it was seen.
Owner pivots
From a network to its registry object, its holder and abuse contact, then to everything else that holder, maintainer or abuse mailbox has registered, at ARIN, RIPE, APNIC, LACNIC and AFRINIC, plus IRR route objects in RADB.
The email layer
SPF includes and ranges, DMARC report mailboxes, DKIM keys and the domains that share them, MX and nameserver fleets: the places abusers reuse infrastructure without meaning to.
Verdicts on every node
Blocklist listings, RPKI invalid routes, domains registered days ago, missing or unconfirmed reverse DNS. Each is a separate signal with its evidence; there is no single score.
Reverse lookups that grow
"Which domains use this nameserver, this DMARC mailbox, this DKIM key?" No live lookup can answer that. Pivot answers from TLD zone files and from an index of everything it has looked up, which grows with every use.
Free, no account. Lookups are rate-limited per network. Pasted messages are analysed and never stored. IP geolocation by DB-IP(CC BY 4.0).