This article documents specialized SPQL data sources that support advanced analysis use cases. These include RDAP registration data, port scanning results, honeypot interactions, host diversity metrics, feed indicators, and additional models for proxies, geolocation, and screenshots.
Specialized Sources
RDAP
Registration data for ASNs and networks, including contact information, status, ranges, and registration dates.
Portscan
Open port observations with transport protocol, timestamps, and related metadata.
Honeypot
Interaction data from honeypots (source IP, protocol, timestamps, etc.).
Host Diversity
Metrics around ASN diversity, IP diversity, and match scores.
Feed
Indicator records with value, type, reputation score, tags, and related metadata.
Other Specialized Models
stalldomain — Stalled domain observations
subdomain — Subdomain-specific records
ipcontent-proxies / ipcontent-vpn — Proxy and VPN indicators
geoip / geoloc — Detailed geolocation fields
screenshot — Screenshot metadata