Host Profile

A report shows one browser visit. A host profile shows everything urlquery's browser has observed about one hostname or IP address across all analyses: the IP addresses it was reached at, its certificates and technologies, the cookies and headers it set, and which other hosts it redirected to, loaded from or was loaded by.

That turns a single report into a starting point. From one phishing page you can find the hosts that share its certificate, the redirectors that send victims to it, and the new hosts that appear when the operator moves.

Where to find it

From	How
A report	Select a hostname in the HTTP transactions or the network graph and open its profile.
Host search on urlquery.net	Enter an exact hostname or IP address to open its profile, or pick a fact type and value to find every host that shares it.
A host page	Every fact on the page, such as an IP address, ASN, certificate or cookie, is a link to the other hosts that share it.
The API and MCP	See Host Profile in the API and MCP.

A host is an exact FQDN, such as login.example.com, or an IP address; a URL is not a host.

How the profile is built

Every processed analysis adds what it observed to the profile of each host it contacted:

• Facts come from the captured HTTP transactions: the IP address a host answered from, its TLS certificate, fingerprinted technologies, cookie names and attributes, response-header names and served MIME types.
• Relations come from what the browser did: a host redirected to, loaded a resource from, called, or embedded another host.
• Counts and times are per report. Each fact or relation records how many reports observed it and when it was first and last observed.

Cookie values and header values are never stored, only names and attributes.

Reading a host page

Header

Item	What it tells you
FQDN or IP	The kind of host.
Rank # or Domain rank #	Popularity in the Tranco list, for the exact host or its registrable domain. A ranked site is popular, not necessarily safe, and compromised popular sites do host malicious content. Rank unknown means neither is ranked.
Newly registered (last N days)	The registrable domain is on an external list of recently registered domains. New domains are common in phishing, but this is context, not a verdict.
Reputation	urlquery's verdict for the host over the last 30 days, shown when you are signed in. "domain-level result" means the verdict applies to the registrable domain, not only this host.

Below the header:

Figure	Meaning
First observed and Last observed	The first and the latest analysis that contacted the host.
Report observations	How many analyses contacted the host.
Unique relation edges	How many distinct hosts relate to it, incoming and outgoing.
Reported registration	The domain's registration date, when known.

Tabs

Tab	What it shows	Use it to
Overview	Other hosts under the same registrable domain, a graph of incoming and outgoing relations, and technology fingerprints.	Get the shape of the host: siblings, who points to it, what it points to, and what it runs.
Discoveries	Facts and relations first observed in the last 24 hours, 7, 30 or 90 days, filterable by kind.	Spot change: a new IP address, a new certificate, a new host sending traffic to this one.
Relations	The newest relations, filterable by direction and type, with a link to each related host.	Follow a chain from redirector to landing page, or find every host that loads a kit's script.
Infrastructure	IP addresses the host was reached at, with ASN, country and observation window.	Find the hosting provider and pivot on the IP address or ASN.
Certificates	TLS certificates the host presented: subject, issuer, validity, observation window and SHA-256.	Pivot on the certificate hash to hosts that presented the same certificate.
HTTP	Cookie names with their attributes, response-header names and served MIME types.	Fingerprint a kit or a panel by its unusual cookies and headers.

Relation types

Relations are directional: the source host did something that involved the target host.

Type	Meaning	Typical in an investigation
Redirects to	The source redirected the browser to the target.	Traffic distribution systems, link shorteners, cloaking and redirect chains.
Loads from	The source loaded a passive resource such as a script, image, stylesheet, font or media file from the target.	Shared kit assets, CDNs, and sites loading an injected script.
Calls	The source made an active request, such as fetch, XHR, a beacon or a websocket, to the target.	Exfiltration endpoints, phishing kit back ends, trackers and command panels.
Embeds	The source framed or embedded the target.	Pages that show another site's content in a frame, such as a fake login inside a lure.

Incoming relations on a host are from the hosts that point to it; outgoing are the hosts it points to.

Pivots

Each fact finds other hosts that share it. Some are far more distinctive than others:

Fact	Finds	How distinctive
Certificate SHA-256 or name	Hosts that presented the same certificate, or certificates with the same issuer or subject name.	Strong for the hash of a certificate covering a few names. Weak for shared CDN or hosting certificates, and for common issuer names such as Let's Encrypt.
Cookie name and attributes	Hosts that set the same cookie the same way.	Strong for an unusual name from a kit or panel; weak for common framework cookies such as session IDs.
Response-header name	Hosts that sent the same header.	Strong for a custom header; weak for standard ones.
IP address	Hosts reached at the same address.	Useful on dedicated servers; weak on shared hosting and CDNs, where unrelated sites share an address.
Domain	Hosts under the same registrable domain.	Good for finding siblings of a phishing host. Weak on shared platforms where many users get subdomains.
ASN and country	Hosts in the same network or country.	Broad context, rarely a pivot on its own.
Technology and MIME type	Hosts with the same software or content type.	Broad; combine with other facts.

Start with the most distinctive fact you have, then check each result's profile before treating it as related.

Using Host Profile in an investigation

Expand from a phishing report

1. In the report, open the profile of the host that served the phishing page.
2. On Overview, check Same domain for sibling hosts, such as other brand names under the same domain.
3. On Certificates, select the certificate hash. Hosts that share a narrow certificate are often the same operator's.
4. On Infrastructure, select the IP address if the host is on a dedicated server, and look for hosts with similar names or the same kit fingerprints.
5. Open the reports for the new hosts with report search, for example http.url.fqdn:login.example.com, to confirm what they served.

Find the redirector in front of a landing page

1. Open the landing page host and go to Relations.
2. Filter on Incoming and Redirects to. These are the hosts that sent browsers here.
3. Open a redirector and filter on Outgoing: its other targets are often other landing pages from the same campaign.

Find sites that load a malicious script

1. Open the host that serves the script.
2. On Relations, filter on Incoming and Loads from. These are the sites that loaded something from it, often compromised sites with an injected script tag.
3. Filter on Calls to see which hosts send it requests, such as beacons or stolen form data.

Fingerprint a kit or panel

1. On HTTP, look for unusual cookie names or custom response headers.
2. Select one to list every host that set the same cookie or sent the same header.
3. Turn what you find into a detection: a YARA rule on the kit's scripts, or indicators for your blocklists.

Watch for new infrastructure

1. Open a host you are tracking and go to Discoveries.
2. Choose a window, such as the last 7 days, to see the IP addresses, certificates and relations first observed in it.
3. A new incoming redirect or a new certificate is often the first sign that a campaign moved.

Interpreting what you see

• It is not passive DNS. IP addresses come from what the browser connected to during an analysis, not from DNS resolution history.
• Observations count reports, not traffic. A host seen in 500 reports was analyzed often, which can mean it is popular, widely reported, or loaded by many pages.
• Times are bounds. First and last observed are the first and the latest analysis that saw a fact. The host may have been active before, after, or only at some times in between.
• Coverage follows submissions. Only hosts that analyses contacted appear, so a missing host or relation only means urlquery hasn't observed it.
• Sharing is not ownership. A shared IP address, certificate, technology or relation is a lead, not proof that two hosts have the same operator or that either is malicious. CDNs, shared hosting, analytics and ad networks connect many unrelated sites.
• Rank and registration are context. A ranked domain can host malicious content, and a newly registered domain can be legitimate.

Privacy

Host Profile is shared by every account and is not filtered by report visibility. Facts and relations from restricted and private analyses add to it, without revealing the reports themselves.

Don't submit internal hostnames or sensitive URLs on the assumption that private visibility keeps their infrastructure out of Host Profile. See Report visibility and Safe use.

Host Profile in the API and MCP

The same data is available for scripts and agents:

• The Host Profile API returns a host's profile, pivots on an exact fact, lists relations, and searches for hosts by observation time and relation shape, such as hosts first observed this month that mostly receive redirects.
• The MCP tools get_host_profile, pivot_host_fact, pivot_host_relations and hunt_hosts give an agent the same pivots.