Intel

The Intel tab contains findings about people and about domains that imitate the organisation. It offers two sub-tabs.

Sub-tab	Content	Prerequisite
Employees	Publicly identifiable employees of the organisation.	A Domain, Email, or administrator-created TLD search term with Employees in its search scope.
Domain squatting	Domains similar to your own that are in use.	The scan option Enable domain squatting on domains.

Employees

N/A means that no data is available for a field. This applies to all columns except Picture, which displays a default avatar when no profile picture is available.

Column	Content
Picture	The profile picture, where available.
Name	The name, with a link to the source profile.
Title	The job title as published.
Employer	The employer as published, with a link to the source profile.
Emails	Email addresses attributed to the person.
Location	The country and, where available, the city.
Passwords	Password data attributed to the person from known leaks.

Actions per person

Select the action menu at the end of the row.

Action	Effect
Show details	Opens the full record for the person.
Employee data enrichment	Requests additional attributes for this person. Consumes employee lookup quota from the company plan.
Export JSON	Downloads the record for this person as JSON.
Delete	Removes the person from the project.

Personal data

The Employees view processes personal data. Restrict access to the project to the people who need it, use Employee data enrichment only where there is a documented need, and observe your organisation's retention rules. Delete removes a record from the project when it is no longer required.

Why this data matters

Employee records are the raw material of social engineering and credential-stuffing campaigns. A record that combines a name, a job title, and an address that appears in a leak identifies an account that should be protected as a priority, for example, by enforcing multi-factor authentication or a password reset.

Domain squatting

The platform generates variants of your domains, checks which of them are registered, and reports what they are used for. This identifies both typo-squatting and deliberate impersonation.

Column	Content
Domain	Your own domain from which the variant was derived.
Domain squatting	The variant that was found.
Fuzzer	The technique that produced the variant. *original marks your own domain itself.
IPv4	The IPv4 addresses the variant resolves to.
IPv6	The IPv6 addresses the variant resolves to.
Email server	The mail server of the variant, where one is published.
Nameserver	The name server of the variant.

Reading the results

The number of entries is normally large, because every generated variant is listed. Two attributes separate the noise from the risk:

Observation	Interpretation
No IPv4, no IPv6, no Email server	Registered but unused. Low priority.
IPv4 or IPv6 present	The variant serves content. Inspect the content.
Email server present	The variant can send and receive mail under a name resembling yours. This is the strongest indicator of a phishing capability and should be assessed first.

Filtering to what matters

Use a column filter on Email server to exclude empty values, and assess those entries first. The generic variants produced by the addition fuzzer are rarely relevant unless they resolve.