Direct answer
Why use a graph? It shows reuse and relationships that flat rows hide.
Entities
Domains, URLs, IPs, brands, phones, IBANs, wallets, handles, certificates, screenshots, kits, sources, evidence and cases.
Relationships
Redirects, shared infrastructure, same kit, same source, same brand, same mule route, same campaign or same evidence bundle.
Outputs
Belgian Live Feed, Campaign DNA, Kit Weakness Intelligence, Operator Discovery, CERT handoff and exports.
How PhishNet uses this
Inside PhishNet this topic is treated as operational graph context: observations are linked to sources, evidence, Belgian relevance, confirmation state, liveness, campaigns and exports. Public pages explain the method; authenticated users can pivot into the full platform workflow when a signal needs investigation or handoff.
Selected sources and research
These pages combine PhishNet platform knowledge with public research, official Belgian sources and open OSINT documentation.
Common questions
Why use a graph?
It shows reuse and relationships that flat rows hide.
Is operator discovery attribution?
No. It is inferred operational clustering unless analyst-confirmed.