# Digital Infrastructure Mapping > Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner — even behind privacy WHOIS and CDNs — via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned. *Source: https://www.whisper.security/docs/workflows/infrastructure-mapping* --- ## How it uses the graph Traverses the DNS, BGP, RPKI, physical, GeoIP, WHOIS, email layers of the graph, in 18 steps: 01. **Registrable apex** _(DNS)_ — Resolving the registrable apex (eTLD+1)… 02. **Operator (atlas)** _(DNS)_ — Attributing the indicator to a known operator… 03. **Registered owner** _(WHOIS)_ — Reading the registrant org, email and registrar… 04. **ASN footprint** _(BGP)_ — Profiling the ASN — prefixes, facilities, exchanges, registrant… 05. **Address attribution** _(BGP)_ — Attributing the address — prefix, ASN, registrant, co-tenants… 06. **IPv6 attribution** _(BGP)_ — Attributing the IPv6 address — prefix, ASN, co-tenants… 07. **Prefix profile** _(BGP)_ — Profiling the prefix — routing ASN, registrant org, member IPs… 08. **Namespace** _(DNS)_ — Sizing the owned subdomain estate via CHILD_OF… 09. **DNS & mail providers** _(DNS, email)_ — Reading nameservers, mail hosts and SPF includes… 10. **Addresses** _(BGP)_ — Resolving the apex to its addresses and their networks… 11. **Owner's other domains** _(WHOIS)_ — Pivoting the registrant email to the rest of the estate… 12. **Organization's registered assets** _(WHOIS)_ — Enumerating the registrant organization's other assets… 13. **Estate hosting spread** _(BGP)_ — Grouping the subdomain estate by hosting ASN… 14. **Subdomain tree** _(DNS)_ — Building the subdomain tree beneath the apex… 15. **De-CDN origins** _(BGP)_ — Discovering the real origin behind any CDN front… 16. **Network topology** _(BGP)_ — Grouping the addresses by ASN and prefix… 17. **Physical footprint** _(physical)_ — Mapping the owning network’s facilities and exchanges… 18. **RPKI coverage** _(RPKI)_ — Counting the owning ASN’s RPKI ROAs… ## Why each step runs 1. **Registrable apex.** whisper.psl.tldPlusOne collapses a deep host to its registrable domain via the Public Suffix List — so a subdomain input attributes to the apex that actually owns the estate, not to its immediate DNS label. 2. **Operator (atlas).** whisper.identify folds the atlas view — the operating vendor, the category (saas / cloud / cdn …) and the derived roles (DNS_OPERATOR / CDN / ORIGIN_AS …) — onto the indicator. When the operator is a CDN or managed host, that is the vendor BORDER, not the owner. 3. **Registered owner.** REGISTERED_BY names the WHOIS registrant; SAME_ORG_AS folds a messy string ("github hostmaster") to the canonical organization ("GitHub, Inc."); the non-privacy HAS_EMAIL is the contact the rest of the estate is pivoted on. A registrant present but all-privacy is flagged, not hidden. 4. **ASN footprint.** For an ASN seed: how many prefixes it routes (ROUTES), how many facilities (AS_PRESENT_AT) and exchanges (IX_MEMBER) it is present at, and its registered name / country / org — the owned network estate. 5. **Address attribution.** For an IPv4 seed: the announcing prefix and ASN (ANNOUNCED_BY→ROUTES) with the ASN name and its registrant org — the owner via the network layer. The hostnames that resolve to it are counted as CO-TENANTS (shared-IP neighbours), not as owned assets. 6. **IPv6 attribution.** The IPv6 twin of address attribution: the announcing prefix and ASN, plus the co-tenant count on the address. 7. **Prefix profile.** For a CIDR seed: the ASN(s) that route it (ROUTES) with their name, the registrant organization (REGISTERED_BY), and how many member IPs it carries — the owned address block. 8. **Namespace.** The subdomains published beneath the apex (CHILD_OF, reverse). The count is the substrate aggregate the canvas draws as "+N"; the sample seeds the graph. The breadth of the owned namespace before per-host enrichment. 9. **DNS & mail providers.** The DNS and mail operators the domain delegates to (NAMESERVER_FOR / MAIL_FOR, reverse; SPF_INCLUDE, out). These are the third-party providers in the footprint — surfaced as the vendor border, not owned assets. The 13 DNS root servers are filtered. 10. **Addresses.** The addresses the apex resolves to (RESOLVES_TO → IPV4), each with its announcing prefix and routing ASN — the owned (or vendor-hosted) addressing, one row per address. 11. **Owner's other domains.** The registrant contact email (HAS_EMAIL, non-privacy) is the strongest ownership pivot: every OTHER domain registered under it (HAS_EMAIL, reverse) is very likely the same owner. Capped at 500 with a saturation flag. 12. **Organization's registered assets.** The other hostnames registered by the same WHOIS ORGANIZATION (REGISTERED_BY, reverse) — the org estate. Reached only via the edge from the apex (never by scanning ORGANIZATION by id). Capped at 200 per org. 13. **Estate hosting spread.** Which networks actually host the owned subdomain estate: sample the resolving subdomains (CHILD_OF → RESOLVES_TO → ANNOUNCED_BY → ROUTES) and tally by ASN. A single dominant ASN is a concentration; a spread across CDNs is the vendor border. 14. **Subdomain tree.** The immediate subdomain layer (CHILD_OF) hung off the apex as a tree — a sample of the owned namespace. Capped at 20 children; the true size lives in the namespace count. 15. **De-CDN origins.** whisper.origins peels back CDN/anycast fronting to the real origin IP and ASN (with a confidence and the method that found it). High-confidence origins are where the owner actually runs the service, behind the vendor border (the confidence bar adapts to the scale whisper.origins returns). 16. **Network topology.** The apex’s addresses as a tree — each address under its announced prefix, each prefix under the ASN that routes it. Parallel ASN subtrees reveal multi-homing (github.com sits on GitHub AND Microsoft), which a flat list hides. 17. **Physical footprint.** The data-center facilities (AS_PRESENT_AT) and internet exchanges (IX_MEMBER) the owning network is present at, as a tree per ASN. The ASN is the seed itself, or the ASN behind the resolved addresses. Sparse for small networks (PeeringDB coverage). 18. **RPKI coverage.** The route-origin authorizations (ROA_AUTHORIZES_ORIGIN) the owning ASN has published — the RPKI posture that protects the owned prefixes from route hijack. May be sparse. [Open the full use-case page, with the live runner](/use-cases/infrastructure-supply-chain/infrastructure-mapping)