WhisperGraph
What the graph contains: seven layers of the internet pre-joined into one queryable graph, at what scale, and where to go deeper.
WhisperGraph Documentation
Whisper Graph maps the internet into one pre-joined graph: DNS, BGP and RPKI routing, WHOIS registration, GeoIP, the open-web link graph, email posture, threat intelligence, and the physical internet of data centers, internet exchanges, and submarine cables. Every domain, IP, ASN, registrant, prefix, and threat feed is a node; every relationship between them is an edge you can traverse.
The difference from a flat lookup tool is the pivot. Anchor on a hostname and you can walk to its IP, the prefix that announces it, the ASN that routes the prefix, the country it sits in, and any feed that lists it, in a single statement.
Feed ingestion is incremental and typically lands within an hour. Two production replicas can hold different freshness for the same node at the same instant — on 2026-08-09 the same IP's threatLastSeen read 1.6 h old on one replica and 41.6 h old on another. Read X-Served-By if freshness matters to your pipeline. Cadence is also per layer rather than global: of the 18 layers GET /api/query/stats reports, one — backbone-cable — is never refreshed, serving a static snapshot while reporting itself ready (measured 2026-08-09).
Read
coveragebeforeband. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says.whisper.explaindoes not returncoverageat all. Full contract: Coverage — what we looked at.
The layers
A short tour, grouped by what each layer answers. The complete label, edge, and property model lives in the Graph Schema.
- Naming, DNS & web — hostnames, TLDs and the subdomain hierarchy, resolution (
RESOLVES_TO,ALIAS_OF), nameserver and mail-server relationships (NAMESERVER_FOR,MAIL_FOR), plus the open web's hyperlink graph (LINKS_TO, from Common Crawl). - Routing & RPKI — ASNs, announced prefixes, live BGP announcements, peering, MOAS conflicts (
CONFLICTS_WITH, the early signal of a hijack), and RPKI ROAs for route-origin validation. - Addressing & geo — IPv4 and IPv6 addresses, the CIDR blocks they belong to, and GeoIP city and country for both IP location and ASN home jurisdiction.
- Ownership & WHOIS — registrars, organizations, registrant emails and phones, and RDAP entities. Pivot from one bad domain to every other domain sharing its registrant.
- Email posture — the full SPF authorization tree, DMARC report targets, DKIM signing vendors, and DNSSEC algorithms, zone by zone.
- Threat intel & actors — 76 feeds in 31 categories via
LISTED_IN, with each listed node carrying one blocking-aware reconciled verdict (verdictScore/verdictLevel/verdictBlocking) plus flags likeisC2,isPhishing, andisTor. Named actors link to the MITRE ATT&CK techniques they use; Tor relays and TLS fingerprints round out the layer. Details in Threat Feeds & Categories. - The physical internet — facilities, internet exchanges, submarine cables and their landings, and CDN PoPs. Cloud regions and DNS root instances sit here too, but both are thin; read What the graph does not hold below before you build on either.
The physical internet and the 10.9B-edge web link graph are layers DNS-only tools don't have at all.
Scale
| Layer | Scale |
|---|---|
| Hostnames | 2.7B |
| IP addresses | 621M IPv4 · 6M IPv6 |
| DNS resolution | 2.9B RESOLVES_TO |
| Web link graph | 10.9B LINKS_TO |
| Routing | 116K ASNs · 2.5M prefixes · 3.7B live announcements |
| WHOIS | 237M emails · 60.2M phones · 119M organizations |
| Threat intelligence | 10.9M LISTED_IN across 76 feeds / 31 categories |
| Total | 7.5B nodes · 39.4B edges |
CALL db.labels() returns current per-label counts, and it answers immediately.
What the graph does not hold
Scale is half the picture. Nothing in the schema is a stub — CALL db.relationshipTypes() YIELD type, count, declaredButEmpty WHERE declaredButEmpty = true returned zero rows on 2026-08-09, so every declared label and edge type carries data. But several planes are thin enough that a pivot into them usually returns nothing at all, and a zero-row result there means Whisper holds no observation — never that there is nothing to find.
| Plane | Measured | What a zero row means |
|---|---|---|
| TLS fingerprints | EMITS_TLS_FINGERPRINT 261 edges over 765 TLS_FINGERPRINT nodes — roughly 260 IPs graph-wide carry one | No observation. Not "this host shares no infrastructure" |
| Certificate Transparency | SEEN_IN_CT 29,453 edges against 2.7B hostnames. github.com has none; paypal.com has none | No CT observation. Not "a clean certificate history" |
| Cloud regions | PREFIX_IN_REGION 3,288 edges against 2.5M prefixes | The prefix is not mapped to a tracked region. Not "not hosted in a cloud" |
| Actor → live infrastructure | ATTRIBUTED_TO 4 edges | Nothing. This plane does not answer the question at all — the ATT&CK layer is a curated reference, not Whisper's own attribution |
RDAP_ENTITY | Carries no edge of any type | Listable, unjoinable — the traversal cannot be written. Reach registration data through EMAIL, PHONE, REGISTRAR and ORGANIZATION instead |
DNS_ROOT_INSTANCE | 1,534 nodes, zero edges | The same: the nodes list, and nothing joins to them |
| IRR AS-SET | CALL whisper.asSet("AS13335") returns zero rows on production | Use ROA_AUTHORIZES_PREFIX / ROA_AUTHORIZES_ORIGIN |
There is also no URL node and no CERTIFICATE node: neither label appears in the 40 rows CALL db.labels() returns. CALL db.schema() still names CERTIFICATE as a source label on TAGGED_AS, so a traversal hint will suggest one — anchor on the IPV4, IPV6, HOSTNAME or ASN forms of that edge instead. Measured 2026-08-09 against production.
One query, every layer
Because the layers are already joined, a cross-layer question is one traversal. Start from an IP and get its announced prefix, the ASN that routes it, the network name, and the country in one round trip:
MATCH (ip:IPV4 {name: "8.8.8.8"})-[:ANNOUNCED_BY]->(ap:ANNOUNCED_PREFIX)-[:ROUTES]->(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
MATCH (ip)-[:HAS_COUNTRY]->(c:COUNTRY)
RETURN ap.name AS prefix, a.name AS asn, n.name AS network, c.name AS country
LIMIT 5
With flat lookup tools that is a WHOIS call, a BGP looking glass, a GeoIP service, and glue code to stitch them together.
A chain this long needs an API key, passed in the X-API-Key header. Sign in to get one — there is no card to enter — then see the Whisper API for endpoints and auth details.
Go deeper
- Graph Schema — the model in three references: Entities (node labels and properties), Connection Types (edge types), and Pivoting Examples (cross-layer chains).
- Threat Feeds & Categories — how feeds enter the graph, the 76-feed catalog, and the 31-category taxonomy.
- Procedures —
explain()for threat verdicts,whisper.variants()for lookalike domains,whisper.history()for point-in-time WHOIS and BGP records, andwhisper.origins()for origin discovery behind CDNs. - Use Case Examples — the same layers applied to real investigations, with runnable workflows and recipes.