Digital Infrastructure Mapping

How it uses the graph

Traverses the DNS, BGP, RPKI, physical, GeoIP, WHOIS, email layers of the graph, in 25 steps:

Why each step runs

1. 01Operator. Names who actually runs the asset and the roles it plays (DNS, mail, CDN, origin), the anchor the whole footprint is attributed to.
2. 02Namespace. Sizes the published namespace through the CHILD_OF tree, the breadth of the footprint before per-host enrichment.
3. 03DNS & mail providers. Surfaces the DNS and mail providers the domain delegates to — the third-party operators woven into its footprint.
4. 04Registered owner. Folds messy registrant strings via SAME_ORG_AS to a clean organisation name plus registrar, the registered-ownership layer.
5. 05Owner’s other domains. Counts the other domains the same email registered — a persistent ownership link that survives IP and nameserver churn.
6. 06Routing footprint (ASN). Sizes the routing footprint of the network behind the indicator, the network-layer concentration input.
7. 07Prefixes → addresses → domains. Drills prefix→IP→domain to make the routed estate concrete — how densely each block is used.
8. 08Interconnection & facilities (ASN). Maps the datacenters and IXes the network sits in, turning the abstract footprint into the physical places an incident would land.
9. 09Cloud region & vendor (prefix). Resolves PREFIX_IN_REGION and DELEGATED_TO to name the cloud region and vendor behind the block, the cloud-dependency layer.
10. 10Resolving IPs. Pins the serving addresses, the seed the geo, network, co-tenancy and physical spread steps all expand from.
11. 11Geographic spread. Maps the jurisdictions the addresses sit in — a single country is a sovereignty concentration, many is resilience.
12. 12Serving network (spread). Resolves each address to its routing owner with country, spreading the footprint across the networks that serve it.
13. 13Serving network — interconnection & facilities. Maps the physical presence of every serving network, extending the physical-concentration view across the whole footprint.
14. 14Origins behind the CDN. Strips the CDN/proxy front to candidate true origin IPs grouped by hosting network — where the asset actually runs.
15. 15Subdomain tree (3 levels). Counts and samples direct, sub-sub and one-deeper names via CHILD_OF, the structured deep view the count step only totals.
16. 16Subdomains → IPs → prefixes → ASNs. Joins the namespace to the full network footprint — every subdomain mapped to where it serves from and the network behind it.
17. 17Mail & SPF provider chain. Collapses mail and SPF-include hosts to each provider's apex so 'outlook.com / msft.net' read as one dependency — the real mail platforms behind the domain.
18. 18Owner estate verification. Pivots back through REGISTERED_BY to corroborate the inferred owner with the breadth of its registered estate.
19. 19Reverse co-tenancy on the serving IPs. Measures co-tenancy per address — a high count is shared/multi-tenant hosting, a low one signals dedicated infrastructure.
20. 20RPKI validity per announced prefix. Classifies each announced prefix by ROA status to grade the serving network's routing integrity prefix by prefix.
21. 21BGP peer reach. Reads BGP_NEIGHBOR breadth to gauge whether each network is well-connected transit or a single-homed stub edge.
22. 22Facility co-location concentration. Reads AS_PRESENT_AT to score physical co-location — a crowded shared site is a single-site exposure / concentration signal.
23. 23Nameserver-provider convergence. The "redundancy that isn’t" detector (INFRASTRUCTURE_MAPPING_WORKFLOW.md §10): several nameservers that resolve onto the SAME provider ASN look diverse but share one real dependency — a resilience gap only the joined graph reveals.
24. 24Geographic concentration. The §9 geographic-concentration analysis: serving addresses funnelled into a single country/jurisdiction are a physical single point of failure the flat map hides.
25. 25CT corroboration. Confirms which de-cloaked origins are genuinely the domain's by showing the Certificate Transparency records seen for it.