Methodology

Evidence sources

ShadowPulse correlates independent sources because no single provider can answer every investigation question.

Start an investigation
No provider account is required. Enter an indicator and ShadowPulse requests the applicable evidence on your behalf.

VirusTotal

IP · Domain · URL · Hash

Vendor detections, reputation, community reports, and sandbox verdicts.

Question answered What do security engines and sandboxes currently report?

Shodan

IP · Domain

Internet-exposed services, ports, host metadata, and DNS context.

Question answered What services and infrastructure are exposed to the internet?

AbuseIPDB

IP

Reported abuse confidence, report volume, and network ownership.

Question answered Has this address been reported for abusive activity?

AlienVault OTX

IP

Pulse correlation, malware references, passive DNS, and related URLs.

Question answered Which threat-intelligence collections reference this address?

IPinfo

IP

Geographic context used by the optional on-demand map.

Question answered What geographic and network context is associated with it?
Interpretation

Missing evidence is not a clean result

A source can have no record, be temporarily unavailable, or not support the indicator type. The deterministic assessment distinguishes insufficient, conflicting, suspicious, and malicious evidence without allowing the AI draft to override it.