Research & OSINT
Study how a region or an org is wired, replay infrastructure at a point in time, and build attribution with runnable workflows and Cypher recipes.
Research & OSINT Documentation
Answering "how is the internet wired here?" usually means stitching RIR allocations, BGP tables, passive DNS, and geolocation datasets that were never meant to join. By the time the joins line up, the dataset is a project, not an answer. WhisperGraph has already done the joins: routing, addressing, naming, ownership, and geography are one graph of ~7.4B nodes and ~39B edges you traverse directly.
That changes what a structural question costs. Which networks announce space in a country, who operates the infrastructure behind a domain, which facilities and exchanges a network touches: each is a query, not a data-engineering sprint. whisper.history() adds the time axis with dated WHOIS and BGP snapshots, so you can replay infrastructure as it looked on a given date.
Attribution work gets the same treatment. WHOIS contacts, registrar chains, hosting, Tor egress, and threat verdicts sit on the same nodes, so the pivot from an indicator to its operator, or from one domain to everything the same registrant holds, stays in one result set with every claim backed by a graph edge.
Run these workflows in your browser
Every workflow below runs live at /use-cases and opens with a result already loaded; swap in your own seed to re-run it. Anonymous runs are capped at 2 hops; a free API key raises that to 3, no card required.
| Workflow | What it does |
|---|---|
| Multi-Attribute Pivot Intersection | Start from a nameserver plus one more attribute (WHOIS email, registrant org, or resolving IP) and AND-intersect them into a tight, selective cluster of domains. |
Several runners that live under neighboring domains carry the Research & OSINT tag too:
- Time Machine diffs an indicator's WHOIS and BGP state between its two most recent snapshots.
- Find Subdomains maps a domain's full subdomain namespace, each host resolved to its IPs, location, and announcing network.
- Digital Infrastructure Mapping takes one indicator to its real owner and full footprint, down to the physical layer.
- M&A / VC Digital-Footprint Diligence builds a hands-off external view of a target's infrastructure, jurisdiction, and ownership.
- Build the Takedown Evidence Package assembles a one-pass dossier: verdict, owner, listing feeds, and the infrastructure around a domain.
Copy-paste recipes
The recipe pages give you the same investigations as Cypher you run yourself:
- Attribution & Law Enforcement goes from an indicator to the responsible operator, its jurisdiction, the full registration record, and a dated evidence packet that survives disclosure.
- Internet Measurement covers bulk and aggregate queries for topology surveys, ecosystem studies, and longitudinal research, written with the bounding that keeps them fast at graph scale.
The pivots behind both pages are cataloged in Cross-Layer Patterns. Keep the Graph Schema open for the label and edge model, and see Procedures for the CALL surface.