# Threat Investigation > The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.' *Source: https://www.whisper.security/docs/workflows/indicator* --- ## How it uses the graph Traverses the threat-intel, DNS, BGP, WHOIS, historical layers of the graph, in 81 steps: 01. **Capability preflight** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the live capability map (which threat layers this server carries)… 02. **Threat-engine reading** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the indicator through explain()… 03. **Suspicion assessment** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Asking whisper.assess for a coverage-qualified suspicion band… 04. **Threat-feed listings** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the actual threat feeds that name the indicator (popularity & ad/tracking lists excluded)… 05. **Popularity / trust context** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Checking popularity/trust & ad-tracking lists (context, NOT threat feeds)… 06. **What this is** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Detecting the indicator type to seed the fan-out… 07. **De-CDN origins** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Discovering the real origin behind any CDN… 08. **Subdomain family** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Deriving the apex and enumerating its subdomains (the whole domain family)… 09. **Infrastructure classification** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Classifying the seed address — CDN/cloud vendor, anycast prefix, co-tenant degree, egress/abuse flags… 10. **Round 1: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-1 hostnames to their IPs, subdomains, parent domain and the sites they link to… 11. **Round 1: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-1 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 12. **Round 1: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-1 ASNs announce… 13. **Round 1: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-1 prefixes and the ASN that routes them (large-provider blocks suppressed)… 14. **Round 2: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-2 hostnames to their IPs, subdomains, parent domain and the sites they link to… 15. **Round 2: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-2 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 16. **Round 2: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-2 ASNs announce… 17. **Round 2: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-2 prefixes and the ASN that routes them (large-provider blocks suppressed)… 18. **Round 3: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-3 hostnames to their IPs, subdomains, parent domain and the sites they link to… 19. **Round 3: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-3 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 20. **Round 3: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-3 ASNs announce… 21. **Round 3: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-3 prefixes and the ASN that routes them (large-provider blocks suppressed)… 22. **Round 4: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-4 hostnames to their IPs, subdomains, parent domain and the sites they link to… 23. **Round 4: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-4 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 24. **Round 4: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-4 ASNs announce… 25. **Round 4: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-4 prefixes and the ASN that routes them (large-provider blocks suppressed)… 26. **Round 5: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-5 hostnames to their IPs, subdomains, parent domain and the sites they link to… 27. **Round 5: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-5 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 28. **Round 5: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-5 ASNs announce… 29. **Round 5: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-5 prefixes and the ASN that routes them (large-provider blocks suppressed)… 30. **Round 6: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-6 hostnames to their IPs, subdomains, parent domain and the sites they link to… 31. **Round 6: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-6 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 32. **Round 6: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-6 ASNs announce… 33. **Round 6: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-6 prefixes and the ASN that routes them (large-provider blocks suppressed)… 34. **Round 7: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-7 hostnames to their IPs, subdomains, parent domain and the sites they link to… 35. **Round 7: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-7 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 36. **Round 7: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-7 ASNs announce… 37. **Round 7: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-7 prefixes and the ASN that routes them (large-provider blocks suppressed)… 38. **Round 8: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-8 hostnames to their IPs, subdomains, parent domain and the sites they link to… 39. **Round 8: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-8 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 40. **Round 8: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-8 ASNs announce… 41. **Round 8: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-8 prefixes and the ASN that routes them (large-provider blocks suppressed)… 42. **Round 9: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-9 hostnames to their IPs, subdomains, parent domain and the sites they link to… 43. **Round 9: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-9 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 44. **Round 9: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-9 ASNs announce… 45. **Round 9: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-9 prefixes and the ASN that routes them (large-provider blocks suppressed)… 46. **Round 10: hostnames → IPs & subdomains** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding round-10 hostnames to their IPs, subdomains, parent domain and the sites they link to… 47. **Round 10: IPs → hosts & prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reverse-resolving round-10 IPs to their hosts and prefix (CDN co-tenancy suppressed)… 48. **Round 10: ASNs → prefixes** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the prefixes round-10 ASNs announce… 49. **Round 10: prefixes → IPs & ASN** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the IPs inside round-10 prefixes and the ASN that routes them (large-provider blocks suppressed)… 50. **Threat sweep across the fan-out** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Threat-checking every discovered node — feeds, threat signals and flags (C2 / malware / phishing / Tor / proxy / botnet / scanner / spam)… 51. **Fan-out recap** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Tallying the fan-out… 52. **MOAS route conflicts (with RPKI status)** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the competing origins of each in-scope prefix, and whether RPKI authorizes them… 53. **RPKI origin authorization** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Counting authorizing ROAs per in-scope network (roa_n = 0 → unverified origin)… 54. **Shared-IP clusters** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Grouping in-scope hosts that resolve to the same IP… 55. **Shared-nameserver clusters** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Grouping in-scope domains served by the same nameserver… 56. **Shared-registrant clusters** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Grouping in-scope domains sharing a registrant email… 57. **Threat density by network** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Measuring the abuse DENSITY of each small in-scope network (listed IPs as a share of the sampled block)… 58. **Egress / anonymizer concentration** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Rolling up in-scope nodes by egress / anonymizer class (Tor / VPN / proxy / exfil)… 59. **Clean-in-toxic contradictions** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Finding SMALL prefixes where clean-looking IPs sit alongside threat-listed ones (provider blocks excluded)… 60. **Abuse-infra neighbours** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Expanding abuse infrastructure harder — threat neighbours of in-scope C2/threat IPs… 61. **WHOIS ownership** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the registrar and registrant contacts… 62. **WHOIS history** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Pulling historical WHOIS snapshots… 63. **Vendor / host identity** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Classifying the host — vendor, category and roles… 64. **Listing vector — feeds, weights & recency** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing vector — feeds, weights & recency… 65. **Threat-class vector — phishing / malware / C2 / spam / anon** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Threat-class vector — phishing / malware / C2 / spam / anon… 66. **Network-neighborhood vector — toxic density on the hosting prefix** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Network-neighborhood vector — toxic density on the hosting prefix… 67. **ASN composite vector — threatDensity / graphMetrics / historical / prefixAge** _(threat-intel, DNS, BGP, WHOIS, historical)_ — ASN composite vector — threatDensity / graphMetrics / historical / prefixAge… 68. **DNS records** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the DNS record set — resolved addresses, nameservers, mail servers, links… 69. **Nameservers & providers** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the nameservers and attributing each to a provider… 70. **Mail servers & providers** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Listing the mail servers and attributing each to a provider… 71. **SPF authorization chain** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Resolving the SPF authorization chain (include / a / mx / ip)… 72. **Network & hosting attribution** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Attributing each hosting address — prefix, ASN, org, geolocation, CDN/cloud vendor… 73. **Physical footprint** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Mapping the physical footprint — facilities and internet exchanges of the owning network… 74. **Address tenancy** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Counting how many other hostnames share each address this indicator resolves to… 75. **Structural context (whisper.walk)** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Asking whisper.walk where this host sits structurally — coverage, nearest known vendors, siblings… 76. **Network reputation** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the reputation the graph already holds for every network the fan-out reached… 77. **Unflagged registrant siblings** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Finding the registrant-shared siblings that sit in NO threat feed… 78. **Abuse signals** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Reading the explicit HAS_SIGNAL edges on every node the fan-out reached… 79. **Tor exit relays on the resolved addresses** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Checking whether any address this indicator resolves to operates a Tor exit relay… 80. **Tor relay record** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Pulling the authoritative relay record (fingerprint, exit addresses, source, ingest time)… 81. **Tor exit presence across the network** _(threat-intel, DNS, BGP, WHOIS, historical)_ — Mapping the whole network's Tor exit presence by block and country… ## Why each step runs 1. **Capability preflight.** db.relationshipTypes()/db.labels() are cheap schema-introspection calls; the flags they yield gate the §9 aggregate pass so a layer absent on this server degrades to a coverage note instead of erroring — the same instructions enrich automatically as layers ship. 2. **Threat-engine reading.** explain() auto-detects the indicator type and returns the graph's own score, level, factors and cited sources — the first-hand observation everything else is read alongside. 3. **Suspicion assessment.** whisper.assess returns a label + band with an explicit coverage qualifier, so a clean read is reported as "known-clean" vs "no-data" rather than silently implying safety. 4. **Threat-feed listings.** Names the LISTED_IN feeds and their categories, EXCLUDING popularity/trust lists (Tranco, Cloudflare Radar — a legitimacy signal, not a threat) and ad/tracking blocklists, so the threat-feed count is real. 5. **Popularity / trust context.** Tranco / Cloudflare Radar top-1M membership is a popularity/legitimacy signal, and ad/tracking blocklists merely flag ad-serving domains — neither is a security threat, so they are reported as CONTEXT, never as a threat hit. (Popularity VDP — returns nothing until the layer ships to prod, then activates automatically.) 6. **What this is.** The indicator is routed into the right typed frontier (hostname / IP / ASN / prefix) so round one expands it by the correct rules. 7. **De-CDN origins.** whisper.origins peels back CDN/proxy fronting to the likely origin IP(s) and network; those origin IPs are seeded into the IP frontier so the fan-out expands the infrastructure that actually serves the content — not the CDN front-end (whose co-tenants are suppressed). 8. **Subdomain family.** Derives the registrable apex with the Public Suffix List and enumerates its subdomain family, each threat-checked. ANCHORED ON THE HOSTNAME LABEL: fed a bare IP, whisper.psl.tldPlusOne happily returns '101.33' as the 'apex' of 185.220.101.33, which then poisons the profile card and the subdomain table. Matching (h:HOSTNAME) first makes the step a clean no-op for an address, network or prefix seed. 9. **Infrastructure classification.** Reads vendor delegation, the prefix anycast flag (ip.isAnycast is null — read it from the prefix), co-tenant degree and the node's own egress/abuse flags to tag the infra class (§15.7). A threat/egress flag on a SHARED address (CDN vendor / anycast / high-degree) is a bad co-tenant, not the seed's own infra, so it does NOT flip a fronted domain to BULLETPROOF/TOR — shared seeds suppress co-tenant fan-out and lean on de-CDN origins; only a DEDICATED abuse address expands HARDER. 10. **Round 1: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 11. **Round 1: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 12. **Round 1: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 13. **Round 1: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 14. **Round 2: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 15. **Round 2: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 16. **Round 2: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 17. **Round 2: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 18. **Round 3: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 19. **Round 3: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 20. **Round 3: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 21. **Round 3: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 22. **Round 4: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 23. **Round 4: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 24. **Round 4: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 25. **Round 4: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 26. **Round 5: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 27. **Round 5: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 28. **Round 5: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 29. **Round 5: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 30. **Round 6: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 31. **Round 6: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 32. **Round 6: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 33. **Round 6: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 34. **Round 7: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 35. **Round 7: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 36. **Round 7: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 37. **Round 7: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 38. **Round 8: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 39. **Round 8: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 40. **Round 8: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 41. **Round 8: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 42. **Round 9: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 43. **Round 9: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 44. **Round 9: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 45. **Round 9: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 46. **Round 10: hostnames → IPs & subdomains.** Each hostname fans out to the IP(s) it resolves to (its hosting), the subdomains beneath it, its parent domain (up to the apex, never the TLD), and the hostnames it links out to — all become nodes the next round expands. 47. **Round 10: IPs → hosts & prefix.** Each IP fans out to the hostnames it serves and the prefix that announces it. CDN/cloud-delegated addresses host millions of unrelated tenants, so their co-tenant promotion is suppressed (DELEGATED_TO a VENDOR) — the de-CDN origins pivot carries the meaningful neighbours instead. 48. **Round 10: ASNs → prefixes.** Each owning network fans out to the prefixes it announces — the address space that depends on it, and the next nodes to expand to their IPs. 49. **Round 10: prefixes → IPs & ASN.** Each prefix fans out to the IPs it contains and the ASN that routes it — but a prefix on a large provider network (anycast / many-prefix ASN / CDN vendor) holds hundreds of unrelated tenants, so its IP expansion is suppressed (the toxic-neighbourhood poison pivot); a small dedicated prefix still reaches its sibling hosts. 50. **Threat sweep across the fan-out.** Every hostname, IP, prefix and ASN reached is read for its own threat listing & level, LISTED_IN feeds, HAS_SIGNAL threat signals and per-node flags — so a compromised node anywhere in the neighbourhood surfaces, not just the indicator itself. 51. **Fan-out recap.** A count of everything reached — hostnames, IPs, prefixes and networks — the strategy expands each branch as far as its signal warrants. 52. **MOAS route conflicts (with RPKI status).** MOAS is USUALLY LEGITIMATE — multihoming, anycast, DDoS scrubbing, aggregation and mergers all look identical to a hijack, and >90% of MOAS prefixes are plain multihoming. So the row that matters is not "is it MOAS" but the per-(prefix, origin) RPKI status: a ROA that covers the prefix but does NOT authorize this origin ('not-authorized') is the only aggravating case, and it is the only one the highlight rules will promote. 'not-found' means no ROA covers the prefix at all — unverifiable, not invalid (only ~45% of routable prefixes carry one). ROAs are typed to PREFIX while routing produces ANNOUNCED_PREFIX, so the join is by NAME — and it must be the UNWIND value `n`, never the bound `ap.name`: anchoring the PREFIX lookup on a bound node property both misses the index (13s — 65x slower than the indexed form) AND silently returns 0 ROAs, which would have reported every MOAS conflict as 'not-found'. Live-validated on 216.168.228.0/24: 180ms, two VeriSign origins, both 'not-authorized'. 53. **RPKI origin authorization.** ROAs are typed to PREFIX and routing produces ANNOUNCED_PREFIX, so bridge through the ASN. roa_n = 0 is a CANDIDATE unverified origin (labelled "unverified", not "invalid") — corroborate per (prefix, origin). 54. **Shared-IP clusters.** Hosts sharing one IP are a co-hosting cluster (size ≥ 2, ≤ 200 — a mapping to hundreds is shared hosting, not a cluster). 55. **Shared-nameserver clusters.** Domains behind one nameserver (NAMESERVER_FOR goes ns→domain) form a shared-NS cluster — a bulk-registration pivot (a boutique NS, not a mega-managed-DNS one with 137k siblings). 56. **Shared-registrant clusters.** Domains registered by one email are a campaign cluster — the highest-value shared-infra pivot (exclude privacy-proxy contacts that map to countless domains). 57. **Threat density by network.** A raw count of threat-listed addresses says nothing without a denominator: 200 listed IPs in a hyperscaler is background noise, 4 in a 30-address block is a toxic neighbourhood. The sampled percentage is what makes the finding promotable (the highlight rules require BOTH a floor on the count and a floor on the density), and capping the sample at 300 addresses keeps the query bounded on a large network. 58. **Egress / anonymizer concentration.** A concentration of egress/anonymizer nodes in one class is a stronger signal than any single hit (per-node flags; no assess round-trip needed). 59. **Clean-in-toxic contradictions.** A clean IP inside a prefix that also carries threat-listed IPs is not "safe" — no-data at the IP granularity inside a hostile neighbourhood is a contradiction worth surfacing (WHOIS/GeoIP mismatch is computed in the handler from whois + origins). 60. **Abuse-infra neighbours.** Co-tenants of a bulletproof/abuse address are likely related bad actors (the opposite of CDN noise) — the highest-value branch to expand, bounded to threat-flagged neighbours in the same prefix. Fires on the aggregate pass or whenever the seed classified as bulletproof/abuse. 61. **WHOIS ownership.** Registrar, registrant org and contact email are the ownership anchors that link this domain to siblings and to known actors. 62. **WHOIS history.** Registration age and the history of registrar/registrant/nameserver changes separate stable assets from freshly-registered, disposable ones. 63. **Vendor / host identity.** whisper.identify maps the host to a canonical vendor, category and role set (CDN, mail receiver, DNS operator…), so known-good infrastructure is recognised rather than re-investigated. 64. **Listing vector — feeds, weights & recency.** Breaks the base score into its direct-listing evidence: every feed that listed the indicator, the weight it contributed, and when it was first and last seen — the sourced, dated rows that justify the verdict to an analyst or auditor. 65. **Threat-class vector — phishing / malware / C2 / spam / anon.** Decomposes the indicator's own verdict into named abuse types — phishing, malware, C2, spam, botnet, DGA, brute-force, scanner, anonymizer/Tor — so the score reads as a class breakdown rather than one opaque number. 66. **Network-neighborhood vector — toxic density on the hosting prefix.** The guilt-by-hosting signal: how many threat-listed IPs share the announced prefix behind the indicator. An IP anchors directly on its prefix; a domain resolves to its serving IPs first, so a clean indicator sitting in a bad block still surfaces the neighbourhood risk. 67. **ASN composite vector — threatDensity / graphMetrics / historical / prefixAge.** Exposes the engine's structured reputation breakdown for the owning network — threat-density, graph-metrics, historical-behaviour and prefix-age sub-scores. Scores the ASN directly when the indicator is one, otherwise resolves the owning ASN behind an IP or domain. 68. **DNS records.** The seed hostname’s resolved v4/v6 addresses, its nameservers and mail servers, any CNAME aliases, and the count of sites it links to and that link to it — the DNS + web-graph facts an analyst reads first. 69. **Nameservers & providers.** Each nameserver (NAMESERVER_FOR goes NS→domain) with the vendor its own address is delegated to — the managed-DNS / hosting provider behind the zone. 70. **Mail servers & providers.** Each mail server (MAIL_FOR goes MX→domain) with the vendor its address is delegated to — who actually receives the domain’s mail. 71. **SPF authorization chain.** The domain’s SPF record expanded one and two levels deep — which hosts, mail exchangers and IP ranges it authorizes to send mail as it — rendered as a tree. 72. **Network & hosting attribution.** For the indicator’s own address(es): the announcing prefix and ASN (with its name), the registered-prefix owner org, the GeoIP city/country, and the CDN/cloud vendor or cloud region — the hosting story as one coherent table instead of five. 73. **Physical footprint.** The data-center facilities (AS_PRESENT_AT) and internet exchanges (IX_MEMBER) the owning ASN is present at — the physical-layer footprint behind the address. Sparse for small networks (PeeringDB coverage). 74. **Address tenancy.** The most load-bearing number in the report: it decides whether co-hosting is evidence at all. On an address with 4,000 tenants, "a flagged domain shares this IP" says nothing — threat actors and enterprises sit on the same shared platforms. On an address with 3, it says a great deal. Every neighbourhood highlight is gated on this class (shared ≥20 / low-density / dedicated ≤2); the count is a capped sample, because the only question ever asked of it is which tenancy band it falls into. 75. **Structural context (whisper.walk).** A novel host is not a clean host. whisper.walk answers the question a feed lookup cannot: does the graph hold ANY structural record of this thing? `no_atlas_match` means it matched nothing we know — which is a coverage statement, not a verdict, and is exactly the case where a not-listed reading is least trustworthy. 76. **Network reputation.** The graph pre-computes a per-ASN reputation (max/avg threat score, overall level, whether it announces threatening prefixes). Running it over the networks the FAN-OUT reached — not just an ASN input — means a domain or IP investigation also gets its hosting network's posture, which is the difference between a boutique bulletproof AS and a Fortune-500 cloud. 77. **Unflagged registrant siblings.** The forward-TI arm: the domains registered by the same contact that NOTHING has flagged yet. If the seed is bad, these are the not-yet-burned infrastructure — the most actionable rows in the whole report, and by definition invisible to every feed lookup. 78. **Abuse signals.** The typed abuse signals (THREAT_SIGNAL_TYPE) are a first-class layer, distinct from the boolean flags and the feed listings — an entity can carry a signal with no feed listing at all. Gated on the PREFLIGHT capability probe, so a server without the layer degrades to a coverage note instead of an error. 79. **Tor exit relays on the resolved addresses.** Anonymised traffic changes how every other piece of evidence is weighed — an exit address is the source of other people's traffic, not necessarily its operator's. Anchoring on the seed AND its resolved addresses (OPERATES_EXIT_NODE runs IPV4 → TOR_RELAY) means a DOMAIN pointing at an exit is caught too, not just a bare IP. Running an exit relay is legal and common for nonprofits and universities: this is context, never a verdict. 80. **Tor relay record.** Only runs once the graph traversal has already found an exit relay, and is bound to THAT address — so the procedure is always handed an IP (it takes a scalar), never a hostname. It adds the provenance the edge alone cannot: which consensus/source recorded it, and when. 81. **Tor exit presence across the network.** The network-scale view: how much of this ASN is Tor egress, and where. Deliberately gated — it only runs when the seed IS a network, or when the seed itself already touched an exit relay, because walking every prefix of an arbitrary hosting ASN is expensive and, for an ordinary domain, pointless. Capped at the first 5 in-scope networks. [Open the full use-case page, with the live runner](/use-cases/threat-investigation/indicator)