there is a machine called "Footprint L1"
Which when you enter a single malicious domain it shows you a nice looking graph of things like
- sub domains
- related IP addresses
- related email addresses
- physical cities/countries of IP addresses
Which can be useful when mapping out an attacker
