Documentation
Whisper Security Documentation
WhisperGraph is the public internet as one queryable graph — DNS, routing, ownership, geography and threat feeds already joined — so a pivot that takes four tools and glue code takes one query.
In category terms: infrastructure intelligence — an enrichment and pivot layer for the indicators you already have. It attaches to the SIEM, TIP, EDR and abuse inbox you already run; it does not replace any of them, and it never sees your traffic.
Every verdict answers two questions, not one: how bad (band) and what we actually looked at (coverage). whisper.assess returns coverage: no-data as a populated row — never an empty result — when Whisper has nothing on a host, so "we have never seen this" cannot be mistaken for "we looked and it is clean."
One indicator, three questions
Nothing here runs until you press it.
1 · The verdict
CALL whisper.assess(["140.82.121.3"]) YIELD host, band, coverage, evidence RETURN host, band, coverage, evidence
captured 2026-08-10
- coverage:malicious-evidenced
- band:LOW
- host-class:unknown
- feed-source:listed
- feed-source-count:1
Two answers, not one. How bad — low. What we looked at — we hold positive evidence, from exactly one feed. A tool that returns only the first number cannot tell you the difference between clean and never seen. Ask it about a host that does not exist:
CALL whisper.assess(["zzz-nonexistent-host-9182.example"])
captured 2026-08-10
- coverage:no-data
- band:UNKNOWN
- host-class:unknown
2 · Why
CALL explain("185.220.101.1")captured 2026-08-10
Sign in to run- Listed in 6 source(s) with combined weight 6.00
- Base score: 6.00 × log₂(6 + 1) = 16.84
- Recency boost: ×1.1 (last seen 1 day ago)
- Age boost: ×1.06 (on lists for 5 days)
- Final score: 16.84 × 1.1 × 1.06 = 19.65
Low risk. Most tools stop here. The score shows its working — and it does not carry coverage, which is why beat one exists.
3 · The mechanism
MATCH (ip:IPV4 {name:"185.220.101.1"})-[:LISTED_IN]->(f:FEED_SOURCE)
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS feed, c.id AS categorycaptured 2026-08-10
Sign in to run| feed | category |
|---|---|
| tor-exit-nodes | tor |
| firehol-abusers-1d | blacklists |
| greensnow | blacklists |
| firehol-level2 | blacklists |
| stopforumspam-listed-ip-7d | spam |
| stamparm-ipsum | blacklists |
That row is not in the score. It changes the ticket.