Help
Learn what ShadowPulse accepts, how to interpret evidence, and how to recover when a provider cannot respond.
Paste one indicator, then review the evidence
The investigation field detects the indicator type automatically. A lookup does not submit files or execute URLs.
8.8.8.8example.comhttps://example.com/pathMD5, SHA-1, or SHA-256Treat evidence and interpretation as separate layers
- 1Start with the deterministic assessment.
It is calculated from provider detections and cannot be overridden by AI.
- 2Compare provider panels.
Sources answer different questions. A clean vendor result does not negate abuse reports or exposed services.
- 3Use the analyst summary as a draft.
It condenses allowlisted provider facts. Verify every conclusion against the source data before acting.
- 4Open community evidence only when needed.
Reports are unverified user content and are intentionally collapsed by default.
Coverage differs by indicator type
Only sources currently shown in the investigation workspace are listed below.
| Provider | IP | Domain | URL | Hash |
|---|---|---|---|---|
| VirusTotal | Yes | Yes | Yes | Yes |
| Shodan | Yes | Yes | — | — |
| AbuseIPDB | Yes | — | — | — |
| AlienVault OTX | Yes | — | — | — |
| IPinfo map | On demand | — | — | — |
Missing provider data means the source does not support that indicator, had no record, was temporarily limited, or could not respond. It is not evidence that an indicator is safe.
Provider access is handled by ShadowPulse
Visitors do not need provider accounts or credentials. ShadowPulse sends the submitted indicator to the applicable evidence sources and returns normalized results; it does not upload files or execute submitted URLs.
Recover from common states
A source is temporarily unavailable
Keep the evidence already loaded and retry later. Never interpret an unavailable source as a clean result.
Request limit reached
Wait briefly before retrying. Repeated refreshes consume the public request allowance without improving the existing evidence.
Indicator is rejected
Remove surrounding prose and submit a single IPv4/IPv6 address, domain, HTTP(S) URL, or 32/40/64-character hexadecimal hash.
Map does not load
The location source or map tiles may be temporarily unavailable. Map assets are requested only after you choose Map location.
Move quickly without losing context
- / or ⌘ K
- Focus investigation search
- ← →
- Move between provider tabs
- Home End
- Jump to the first or last provider tab
- Esc
- Close mobile navigation