# Attack-Surface Mapper > See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside. *Source: https://www.whisper.security/docs/workflows/attack-surface* --- ## How it uses the graph Traverses the DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical layers of the graph, in 30 steps: 01. **Asset verdict** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Scoring the domain with explain()… 02. **Asset class** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Identifying the domain's vendor and class… 03. **CT-log subdomains** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Mining CT logs for certificate-named subdomains… 04. **Nameservers** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Finding the domain's nameservers… 05. **Subdomain-takeover candidates** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Finding CNAMEs pointing at dangling targets… 06. **Dangling delegations — true count** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — How many subdomains point at a CNAME target that resolves to nothing at all. 07. **CNAME delegation targets** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Inventorying every CNAME (ALIAS_OF) delegation target the namespace makes… 08. **SaaS delegation — true count** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — How many subdomains delegate to a third-party platform, in total. 09. **Mail servers** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Finding the domain's mail servers… 10. **SPF authorized senders** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Reading the domain's SPF-authorised senders… 11. **DMARC reporting** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Reading the domain's DMARC report recipients… 12. **Registrar & registrant** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Reading registrar, registrant and email… 13. **Sibling domains (registrant-email pivot)** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Pivoting on the registrant email to co-registered domains… 14. **Look-alike / typosquat domains** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Enumerating registered look-alike domains… 15. **Real origins (de-CDN)** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — De-CDN'ing to the real origin IPs… 16. **Resolving IPs** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Resolving the apex to its IPs… 17. **Serving network (IP → ASN)** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Tracing serving IPs to ASN, country and threat… 18. **Cloud regions** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Mapping serving prefixes to their cloud region… 19. **Hosting-network reputation** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Assessing each serving ASN's reputation with explain()… 20. **Physical footprint** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Tracing serving ASNs to the datacenters they sit in… 21. **TLS fingerprints** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Collecting the serving IPs' TLS fingerprints… 22. **Neighborhood threat** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Counting flagged domains on the serving IPs… 23. **Total subdomain count** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Total subdomain count… 24. **Subdomain hosting map** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Subdomain hosting map… 25. **Hosting diversity** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Hosting diversity… 26. **Domains hosted on this ASN** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Domains hosted on this ASN… 27. **Branded name search** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Branded name search… 28. **Inbound web links** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Inbound web links… 29. **Outbound web links** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Outbound web links… 30. **Mutual web links** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Mutual web links… ## Why each step runs 1. **Asset verdict.** Sets the headline threat verdict for the asset before the surface is enumerated, framing how risky the footprint is. 2. **Asset class.** Reads host-class and roles so a CDN or shared platform reads as structure rather than as an attacker-controlled asset. 3. **CT-log subdomains.** Reads CT_OBSERVATION names to recover subdomains that issued TLS certs — hosts DNS enumeration alone may miss. 4. **Nameservers.** Walks NAMESERVER_FOR (excluding root servers) to name the DNS operators the domain delegates to — its control-plane dependency. 5. **Subdomain-takeover candidates.** Flags subdomains whose ALIAS_OF target no longer resolves — classic subdomain-takeover candidates an attacker can claim. 6. **Dangling delegations — true count.** A subdomain whose target resolves to no address is the classic takeover setup. This is the flow's most actionable finding, so it is counted over EVERY delegation rather than over the 50 that happen to fit in the sample. 7. **CNAME delegation targets.** Walks every subdomain's ALIAS_OF target to inventory every CNAME delegation the namespace makes. Most rows are first-party infrastructure aliases (e.g. a domain's own edge/CDN names), not third-party SaaS — the row count overstates the true supply-chain surface, so read this as a delegation inventory, not a SaaS count. `target_ips` is the resolved IPv4 count for the CNAME target; it is not a takeover signal on its own — see subdomain-takeover for the dedicated dangling-CNAME check. 8. **SaaS delegation — true count.** The delegation list is capped at 50 rows. Counting the rows counts the cap, not the dependencies — so the total is measured separately and never truncated. 9. **Mail servers.** Walks MAIL_FOR to surface the mail exchangers, part of the email attack surface and a spoofing/relay consideration. 10. **SPF authorized senders.** Enumerates every SPF mechanism (include/ip/a/mx/exists/redirect) and its target, the full set of hosts allowed to send as the domain. 11. **DMARC reporting.** Surfaces the DMARC_REPORTS_TO recipients, indicating whether email-authentication reporting is configured and where it lands. 12. **Registrar & registrant.** Captures the WHOIS ownership trail — registrar, organisation, contact email — the human/legal layer of the surface. 13. **Sibling domains (registrant-email pivot).** Pivots on the apex's WHOIS registrant email to the other domains it registered (privacy/role addresses excluded, expansion capped per email so a shared address can't explode) — the org-expansion step the single-domain pass skips. HIGH-confidence only when the email is exact and the portfolio is small; corroborate before trusting. 14. **Look-alike / typosquat domains.** Generates typo/homoglyph variants of the apex and keeps only the REGISTERED ones — the brand/typosquat surface. Most are owned by unrelated parties; score each before alerting. 15. **Real origins (de-CDN).** Runs whisper.origins to reconstruct the true server addresses behind any CDN — the real infrastructure the edge hides. 16. **Resolving IPs.** Pins the addresses the domain resolves to, the anchor the serving-network, TLS and threat steps all key off. 17. **Serving network (IP → ASN).** Resolves IP→prefix→ASN with country and IP threat flags, naming the network that serves the domain and its reputation. 18. **Cloud regions.** Maps each serving prefix to its CLOUD_REGION (e.g. aws:eu-west-1) — exact data-residency and blast-radius the country-level GeoIP alone misses. 19. **Hosting-network reputation.** Runs explain() on each serving ASN for its neighborhood reputation — a high-abuse hosting network is a real signal the per-IP threat view misses, even when the domain's own IPs are clean. 20. **Physical footprint.** Walks AS_PRESENT_AT to the physical facilities the serving ASN occupies — the supply-chain/physical layer no subfinder/Shodan pipeline can reach. Live on prod: a serving ASN can carry from a handful up to well over a thousand facilities (e.g. 45 for AS36459, 1,154 for AS8075) — often the richest layer in the run. 21. **TLS fingerprints.** Reads EMITS_TLS_FINGERPRINT to capture each address's TLS stack signature, a clustering and posture signal across the surface. 22. **Neighborhood threat.** Measures how many co-tenants on the domain's own IPs are already threat-listed — how risky the hosting neighbourhood is. 23. **Total subdomain count.** Reports the true size of the domain's namespace by suffix match (ENDS WITH '.'), so the surface enumeration is framed against the real total. This is a broader, name-pattern count than the CHILD_OF-edge subdomain count reported elsewhere in the registry (e.g. indicator-enrichment's "Subdomains & parent") — ENDS WITH also catches names with no materialized CHILD_OF edge, so the two totals can legitimately differ. 24. **Subdomain hosting map.** Ties each subdomain to the IP, prefix and network that host it, showing exactly where the externally exposed surface lives. 25. **Hosting diversity.** Counts how many subdomains sit on each hosting network, showing whether the footprint is concentrated on one provider or spread across many. 26. **Domains hosted on this ASN.** When the input is an ASN, enumerates the domains living inside that network's address space so the surface can be mapped network-first. 27. **Branded name search.** Surfaces every registered hostname that begins with the given string, catching related or brand-impersonating names outside the direct subdomain tree. 28. **Inbound web links.** Lists the sites that hyperlink to the domain, mapping its inbound web-link graph and who references it. 29. **Outbound web links.** Shows which external sites the domain links out to, part of its web-facing surface and third-party exposure. 30. **Mutual web links.** Finds reciprocal hyperlinks between the domain and its peers, which often signal partnerships or affiliations worth investigating. [Open the full use-case page, with the live runner](/use-cases/attack-surface-recon/attack-surface)