Foundations
Most internet intelligence comes from fragmented sources of questionable accuracy—DNS feeds that aren’t mapped to IP ownership data, geolocation databases based on outdated guesses, port scanners that miss most of IPv6. These tools don’t talk to each other. When they disagree, you’re left guessing which one to trust.
Oscar takes a different approach. We built the Mosaic, a comprehensive knowledge graph that maps the internet. We collected the best ground truth on the logical and physical layers from over 1,000 vantage points across the globe. Because every piece of data can inform every other piece, our accuracy compounds. We use what we learn about routers to improve our geolocation, what we know about IP ownership to organize our domain data, and what we uncover about IPv6 to expand our port scanning. The whole becomes greater than the sum of its parts.
A single router often has dozens of IP addresses. A competitor who considers each address in isolation would need to correctly geolocate all of them independently. If a router has 50 addresses, they'd need to be right 50 times. By resolving those addresses to a single device, we share clues across all of them. A geolocation discovery on one address lets us pinpoint the other 49 with precision, while our competitors are left guessing.
Standard tools can’t answer intuitive questions like “show all domains corresponding to servers in this country” or “list every domain belonging to a particular organization.” These queries look simple. Under the hood, they require multiple data sources that don’t speak to each other. Because Oscar links them together, the search just works.
Comprehensive port scanning requires knowing what to scan. We’ve identified far more relevant IPv6 addresses than well-known scanning services, because we draw on addresses discovered through many other techniques. Our scanning approach is thoughtful: the payoff is that we uncover multiple web servers behind a single IP that other competitors miss.
Port scanning data, protocol responses, and certificate information combine to identify specific hardware and software—not just that a device is a router, but that it running a particular firmware version with known vulnerabilities. This turns raw scan data into actionable intelligence about vendor dependencies and security exposure.
The Mosaic is informed by a global collector network: over 1,000 servers distributed across more than 130 countries. We collect data on tens of billions of internet properties. We maintain presence in every major cloud provider, in small regional providers, and—deliberately—in networks known to harbor criminal infrastructure. Seeing what attackers see means collecting from the same places they operate.
This distribution matters. You can’t reliably see into a country, or understand routing paths, without collectors inside those countries. We receive continuous telemetry from this network for processing, analysis, and integration into the platform.
Our geolocation data also includes precise positions for billions of Wi-Fi-enabled devices, useful for finding infrastructure near geographic points of interest.
The Mosaic
A single source of truth
One unified view
Many of our customers grew frustrated juggling dozens of commercial and open-source feeds. The feeds contradicted each other—different geolocation, conflicting ownership data, gaps in IPv6 coverage. Ten wrong answers don’t add up to a right one. Oscar replaces that patchwork with a unified view. Drill in and out to different layers of the network, visualize patterns, understand relationships, and track changes over time.
The structure of the internet
The Mosaic’s structure mirrors the internet itself. Analysts can search it through any layer, combining and recombining tiles that show anything from the the routing dependencies of a critical infrastructure provider, the certificate history of a domain, or a particular vendor’s router running vulnerable firmware in a given data center. It’s all drawn from one unified Mosaic, so data is consistent and up to date. The platform moves between layers with a single click—domains to IPs, IPs to routers, routers to facilities—because these aren’t separate databases.
Your questions, answered
Our customers ask tricky questions. You might want to understand your surface from multiple dimensions—for instance, including your subsidiaries, supply chain providers, or upstream routing dependencies. We let you flexibly define searches. With pattern discovery, you can surface previously unknown assets that share characteristics—overlapping certificates, similar port configurations, shared physical infrastructure.
Our templates and reports help analysts get up to speed quickly and apply proven approaches to new problems. Your own reports can be shared easily, and securely, within and across organizations.
