# Indicator Enrichment > Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it. *Source: https://www.whisper.security/docs/workflows/indicator-enrichment* --- ## How it uses the graph Traverses the WHOIS, DNS, email, BGP, TLS, threat-intel layers of the graph, in 19 steps: 01. **Registration identity** _(WHOIS)_ — Reading the registrant organization and contacts… 02. **WHOIS history** _(WHOIS)_ — Pulling historical WHOIS snapshots… 03. **Role in the graph** _(DNS)_ — Inferring the host’s own role — nameserver, mail server, SPF sender… 04. **Registrable apex** _(DNS)_ — Resolving the registrable apex (eTLD+1)… 05. **Vendor & category (atlas)** _(DNS)_ — Attributing the indicator to a known vendor and category… 06. **Subdomains & parent** _(DNS)_ — Counting the subdomain family… 07. **Nameservers** _(DNS)_ — Listing the authoritative nameservers… 08. **Mail servers** _(email)_ — Listing the mail exchangers… 09. **Resolution** _(DNS)_ — Resolving the domain to its A / AAAA addresses… 10. **SPF authorization chain** _(email)_ — Resolving the SPF authorization chain (include / a / mx / ip)… 11. **CNAME aliases** _(DNS)_ — Following CNAME aliases in and out… 12. **Web links** _(DNS)_ — Counting inbound / outbound web links… 13. **Network & hosting attribution** _(BGP)_ — Attributing each hosting address — prefix, ASN, org, geolocation, CDN/cloud vendor… 14. **Network topology** _(BGP)_ — Grouping the resolved addresses by ASN and prefix… 15. **Co-hosted hostnames** _(DNS)_ — Reverse-resolving the address to its co-hosted hostnames… 16. **ASN profile** _(BGP)_ — Profiling the ASN — name, country, prefixes, peers… 17. **Routed prefixes** _(BGP)_ — Sampling the prefixes the ASN routes… 18. **Prefix profile** _(BGP)_ — Profiling the prefix — routing ASN, registrant org, cloud region… 19. **Physical footprint** _(BGP)_ — Mapping the physical footprint — facilities and internet exchanges… ## Why each step runs 1. **Registration identity.** REGISTERED_BY / HAS_EMAIL / HAS_PHONE — the ownership anchors that link the domain to siblings. The human registrar is not here (HAS_REGISTRAR is an opaque iana code); it lives in the WHOIS history. 2. **WHOIS history.** whisper.history.whois carries the readable registrar/registrant/expiry and the nameserver set at each observation — the record the scrubber reads as of any date. Age and change cadence separate a stable asset from a freshly-registered one. 3. **Role in the graph.** Outbound NAMESERVER_FOR makes a host a nameserver, MAIL_FOR a mail exchanger, an inbound SPF mechanism an authorised sender. Counting each — capped and saturation-flagged — tells the reader what this host DOES for others, not only what it is called. 4. **Registrable apex.** whisper.psl.tldPlusOne collapses a deep host to its registrable domain using the Public Suffix List — the only correct way to say "a subdomain of X" when the immediate DNS parent is itself a subdomain. 5. **Vendor & category (atlas).** whisper.identify folds the atlas’s own view — the operating vendor, the category (saas / cloud / …), the derived roles — onto the indicator, so the profile carries an attribution even where no single edge spells it out. 6. **Subdomains & parent.** The subdomains beneath the host (CHILD_OF, reverse). The count is the substrate aggregate the canvas draws as "+N"; the sample seeds the graph. 7. **Nameservers.** The authoritative nameservers (NAMESERVER_FOR goes NS→domain). The 13 DNS root servers (a–m.root-servers.net) are filtered — they appear as NAMESERVER_FOR edges on many domains as a resolution-trace artifact (bupa.com.au and stripe.com each carry all 13) but are never a domain’s actual authoritative NS, and they inflate the count. Names only — resolving each NS to a provider 524-times-out when a domain does delegate to root servers. 8. **Mail servers.** The mail exchangers (MAIL_FOR goes MX→domain). Names only — resolving each MX to a vendor is slow (a big MX resolves to hundreds of IPs) and the exchanger name already names the provider. 9. **Resolution.** RESOLVES_TO → IPV4 and IPV6 — the addresses the domain actually points at, counted for the lede and grouped into the network tree. 10. **SPF authorization chain.** The domain’s SPF record one and two levels deep — which hosts, exchangers and IP ranges it authorizes to send mail as it. 11. **CNAME aliases.** ALIAS_OF both ways — what this host is a canonical name for, and what points at it. 12. **Web links.** How the wider web references this host and what it references (LINKS_TO) — the web-graph footprint, capped at 50k with a saturation flag so a huge hub reads "50,000+" rather than a wrong exact number. 13. **Network & hosting attribution.** For the indicator’s own address(es): the announcing prefix and ASN (with name), the registered-prefix owner org, the GeoIP city/country (with lat/lon for the map link), and the CDN/cloud vendor or cloud region — the hosting story as one table. 14. **Network topology.** The resolved addresses as a tree — each address under its announced prefix, each prefix under the ASN that routes it. Multi-homed hosts (github.com sits on GitHub AND Microsoft) show as parallel ASN subtrees, which a flat table hides. 15. **Co-hosted hostnames.** For a raw IP: every hostname RESOLVES_TO it — the co-tenants sharing the address. A Fastly anycast address carries thousands; a dedicated host, one. 16. **ASN profile.** For an ASN seed: its registered name (HAS_NAME), country, registrant org, the count of prefixes it routes (ROUTES) and of ASNs it peers with (BGP_NEIGHBOR). 17. **Routed prefixes.** For an ASN seed: a sample of the prefixes it originates (ROUTES), as a tree hung off the ASN. Capped at 12 — a large transit AS routes thousands, and the count in the profile carries the true total. 18. **Prefix profile.** For a CIDR seed: the ASN(s) that route it (ROUTES) with their name, the registrant organization, any cloud region, and how many member IPs it carries. 19. **Physical footprint.** The data-center facilities (AS_PRESENT_AT) and internet exchanges (IX_MEMBER) the owning network is present at, as a tree per ASN. Sparse for small networks (PeeringDB coverage). ## Key concepts - [WHOIS](/glossary/whois) - [SPF](/glossary/spf) - [Certificate transparency](/glossary/certificate-transparency) [Open the full use-case page, with the live runner](/use-cases/dns-email-security/indicator-enrichment)