Reference
Cybersecurity Glossary
Plain-language definitions of the terms that show up in real infrastructure investigations. Each entry includes how the concept is used in practice and where it intersects with the rest of the graph.
DNS & Domains
How names resolve to infrastructure — and how attackers abuse the lookup chain.
Certificate Transparency
Certificate Transparency (CT) is a public-log system that records every TLS certificate issued by participating Certificate Authorities. Every modern browser refuses certificates that are not in CT, which means defenders, brand-protection teams, and attackers all have access to a near-complete public ledger of who has been issued certificates for which hostnames.
Co-hosted Domains
Co-hosted domains are hostnames that resolve to the same IP address — meaning they share a server. In bulk shared hosting this is benign and meaningless; in attacker infrastructure, co-hosting is one of the strongest signals available, because operators routinely group campaign assets on the same machine.
DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS-published email policy that tells receivers how to handle messages failing SPF or DKIM checks. It lets domain owners block spoofing of their own domain and receive reports on who is sending mail in their name.
DNS
The Domain Name System (DNS) is the address book of the internet. It translates human-readable hostnames like example.com into the IP addresses, mail servers, and other records computers actually use to communicate. Almost every internet transaction begins with a DNS lookup.
DNSSEC
DNSSEC (Domain Name System Security Extensions) is a set of DNS protocol extensions that add cryptographic signatures to DNS records. Validating resolvers can use those signatures to confirm that an answer came from the legitimate authoritative server and was not modified in transit.
Domain Generation Algorithm (DGA)
A Domain Generation Algorithm (DGA) is a piece of malware logic that algorithmically produces a steady stream of pseudo-random domain names — often hundreds or thousands per day — for use as command-and-control rendezvous points. The malware tries to resolve each one until it finds a domain the attacker has registered, defeating static blocklists.
Fast Flux DNS
Fast flux is a DNS technique that rapidly rotates the IP addresses associated with a hostname — sometimes every few minutes — across a large pool of compromised hosts. The hostname stays alive while the IPs underneath churn, which makes IP-based blocking ineffective and helps malicious infrastructure stay reachable.
Origin-IP Discovery
Origin-IP discovery — also called de-cloaking or de-CDN — is finding the true server IP behind a CDN or reverse proxy like Cloudflare. The CDN hides the origin, but historical DNS, certificates, SPF records, and sibling domains often leak it, so an attack-surface or pentest team can reach the real host their scanner actually needs to test.
Passive DNS (pDNS)
Passive DNS is the historical record of every DNS resolution observed in the wild — capturing every hostname-to-IP mapping over time without ever issuing a query of its own. Where active DNS gives you the answer right now, passive DNS gives you every answer the system ever returned, with timestamps, so you can replay the past.
RDAP (Registration Data Access Protocol)
RDAP is the structured, JSON-based successor to WHOIS for looking up who registered a domain, IP block, or AS number.
Reverse DNS / PTR
Reverse DNS (rDNS) is the lookup that goes the other way: given an IP address, return the hostname assigned to it. The mapping is published as PTR records under the special .in-addr.arpa (IPv4) and .ip6.arpa (IPv6) zones, and is controlled by whoever owns the IP block — the network operator, not the domain owner.
SPF
SPF (Sender Policy Framework) is a DNS record listing the mail servers authorized to send email for a domain. Receiving servers check it to detect forged sender addresses, making SPF a first line of defense against domain spoofing and phishing.
Subdomain Enumeration
Subdomain enumeration is the discovery of all the subdomains beneath a domain — mail, vpn, staging, dev — to map an organisation's external footprint. Passive enumeration finds them from data the internet already exposes (the DNS hierarchy, Certificate Transparency logs, passive DNS) without sending a single packet to the target.
Typosquatting
Typosquatting is the registration of domain names that imitate a legitimate brand — usually by exploiting common typos, character substitutions, or visually similar Unicode characters. The squatter relies on users mistyping a URL or failing to spot a swapped character, then collects the misdirected traffic for phishing, malvertising, or credential theft.
WHOIS
WHOIS is the public registration record for domain names and IP allocations. It tells you who registered a domain (or who an IP block is assigned to), through which registrar, when, and how to contact them. WHOIS has been the canonical answer to "who owns this" on the internet since the early 1980s.
Routing & Network
BGP, autonomous systems, and the physical and logical paths traffic takes.
ASN Footprint
An ASN footprint is the full set of IP prefixes, hosts, and services an organization announces or operates under its Autonomous System. Mapping it reveals the true edge of a network — including forgotten or shadow infrastructure that traditional asset inventories miss.
ASN Reputation
ASN reputation assesses how trustworthy a whole network is — based on the threat activity observed across the prefixes it routes, not just a single blocklist hit.
Autonomous System (ASN)
An Autonomous System is a network — or group of IP prefixes — operated by a single organization with one consistent routing policy. Each AS is identified by a unique Autonomous System Number (ASN) assigned by a Regional Internet Registry, and uses BGP to exchange routes with other ASNs.
BGP Hijacking
BGP hijacking is the unauthorized announcement of IP prefixes by an autonomous system that does not own them. Because BGP has no built-in authentication, peers may accept the false announcement and start routing traffic for the hijacked prefix to the wrong network — enabling interception, surveillance, or denial of service.
BGP Routing
Border Gateway Protocol (BGP) is the routing protocol that connects autonomous systems across the internet. It decides how traffic flows between organizations by exchanging announcements about which IP prefixes each network can reach. Every packet that crosses an organizational boundary is routed by BGP.
Internet Exchange Point (IXP)
An Internet Exchange Point (IXP) is a physical location where many networks interconnect to exchange traffic directly, rather than paying a transit provider.
MOAS Conflict
A MOAS (Multiple Origin AS) conflict is when the same BGP prefix is announced by more than one autonomous system — sometimes a route hijack, sometimes legitimate anycast.
RPKI / Route Origin Authorization (ROA)
RPKI lets a network cryptographically authorize which AS may originate a prefix. The signed record is a ROA — a Route Origin Authorization.
Route Origin Validation
Route Origin Validation (ROV) is the BGP process of checking a route advertisement against RPKI data to confirm the announcing AS is authorized to originate that prefix. It lets routers reject invalid or hijacked routes before they propagate across the internet.
Submarine Cable
Submarine cables are the undersea fibre-optic lines that carry almost all intercontinental internet traffic. Because a handful of cables and their landing stations carry so much, they are a physical single point of dependency — now a focus of the FCC's 2026 cable-security rules and the EU's Cable Security Toolbox.
Threat Intelligence
The tradecraft of finding, tracking, and attributing malicious infrastructure.
Bulletproof Hosting
Bulletproof hosting is hosting that is deliberately resistant to abuse complaints, takedown notices, and law-enforcement requests. Operators advertise tolerance for content that mainstream providers remove — phishing kits, malware C2, spam infrastructure, illegal content — usually by operating in jurisdictions with weak enforcement and aggressive customer protection.
C2 (Command and Control) Infrastructure
Command-and-control (C2) infrastructure is the network of servers, domains, and channels an attacker uses to control compromised systems after initial access. C2 is how malware on a victim's machine receives instructions, exfiltrates data, and is updated. Mapping C2 is mapping the attacker's nervous system.
Forward Threat Intelligence
Forward threat intelligence is finding an adversary's infrastructure before it is used — the not-yet-weaponised domains and servers an operator has staged but no feed has flagged. It is the opposite of reactive intelligence: instead of listing what is already burned, it surfaces the next wave by pivoting on shared fingerprints.
Indicator of Compromise (IOC)
An Indicator of Compromise (IOC) is a forensic artifact — an IP address, domain, file hash, URL, registry key, or network signature — whose presence on a system or in network traffic suggests the system has been targeted, infected, or breached. IOCs are how defenders translate threat intelligence into things they can actually search for.
Infrastructure Pivoting
Infrastructure pivoting is moving from one known indicator — a domain, IP, or certificate — to related infrastructure by following shared attributes: the same IP (co-hosting), the same WHOIS registrant, shared nameservers, or a shared TLS fingerprint. Each shared attribute is a pivot, and chaining pivots expands a single lead into a whole campaign.
MITRE ATT&CK
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised into a matrix. It gives defenders a shared vocabulary (technique IDs like T1059) for describing how an actor operates, from initial access to exfiltration.
TLS Fingerprint (JA3 / JARM)
A TLS fingerprint (JA3 or JARM) is a compact hash of how a server or client negotiates a TLS handshake — a way to identify software and infrastructure even as IPs and domains change.
TTPs (Tactics, Techniques, and Procedures)
TTPs — tactics, techniques, and procedures — describe how a threat actor operates: the goals they pursue (tactics), the methods they use (techniques), and the specific way they execute them (procedures). Because TTPs are harder to change than tools or domains, they are the most durable way to track an adversary.
Threat Hunting
Threat hunting is the proactive, hypothesis-driven search for adversaries inside an environment — under the assumption that prevention will fail and that automated detection has missed something. Hunters start with a hypothesis ("if X actor were here, we would see Y"), gather evidence, and either confirm an intrusion or sharpen detection for next time.
Threat Intelligence
Threat intelligence is information about cyber threats — the actors, campaigns, tools, and infrastructure behind attacks — that has been collected, analysed, and refined into context defenders can act on. The goal is not raw data; it is helping security teams make faster, better-informed decisions about what to block, what to investigate, and what to ignore.
Tor Exit Node
A Tor exit node is the last relay in the Tor network — the IP that traffic appears to come from when a Tor user reaches a site. Exit-node IPs are frequently flagged in threat feeds.
Attack Surface & Risk
Mapping exposure, choke points, and blast radius across an organisation.
Attack Path Analysis
Attack path analysis maps the chain of steps an attacker takes from an entry point to a target, then identifies the choke point that severs the most paths. Whisper extends it across the open internet — web, DNS, routing, and physical layers — rather than inside one organisation.
Attack Surface
An attack surface is the complete set of points — domains, subdomains, IP addresses, exposed services, third-party integrations — where an unauthorized actor could probe, interact with, or attempt to enter an organization's systems.
Attack Surface Management
Attack surface management (ASM) is the continuous discovery and monitoring of everything an organisation exposes to the internet — domains, subdomains, IPs, certificates, and the services on them. External ASM does this from the outside, the way an attacker sees you, so forgotten and shadow assets surface before they are exploited.
Blast Radius
Blast radius is the scope of systems, services, and dependencies a single compromised asset can reach or take down. In infrastructure terms it measures how far an attacker — or an outage — can propagate from one host, domain, or provider before containment stops it.
Choke Point Analysis
Choke point analysis finds the single node that, when removed, severs the largest number of attack paths. In Whisper's external graph, a choke point is a shared-infrastructure node — a common IP, prefix, ASN, registrant, or data center — that ties an attacker's assets together.
Concentration Risk
Concentration risk is the danger that too much of an organisation's infrastructure depends on a single provider, network, or facility — so one outage or compromise cascades across everything at once. DORA (Art. 28–30) now requires firms to analyse ICT concentration and hold exit strategies for it.
Coverage-Qualified Assessment
A coverage-qualified assessment is a threat verdict that states how much the system actually knows about the target — distinguishing 'known clean' from 'no data'. It prevents the dangerous default where absence of evidence is read as evidence of safety, which matters most when an AI agent acts autonomously.
Reconciled Verdict
A reconciled verdict is Whisper's single, blocking-aware threat assessment for an indicator — a score, a level, and a block/allow recommendation reconciled across many feeds and signals.
Supply-Chain Risk
Supply-chain risk in cybersecurity is exposure inherited from the third parties an organisation depends on — hosting providers, DNS operators, registrars, and the networks beneath them. A compromise or outage anywhere in that chain becomes your incident, which is why NIS2 Art. 21 makes supply-chain security a board-level duty.
Graph, AI & Querying
The graph model and the tools — Cypher, MCP — for asking it questions.
Cypher (Query Language)
Cypher is a declarative query language for graph databases. Originally developed at Neo4j and now standardized as openCypher (and ISO/IEC GQL), Cypher uses ASCII-art-like patterns — (a)-[:KNOWS]->(b) — to describe nodes, edges, and traversals. It reads like a sentence and maps directly to how analysts already think about graph problems.
Infrastructure Intelligence
Infrastructure intelligence is the real-time collection, correlation, and analysis of internet infrastructure data — BGP routing, DNS, hosting, WHOIS, DNSSEC, certificate transparency — so security teams can detect, attribute, and respond to threats based on how attackers actually deploy their tools.
Knowledge Graph
A knowledge graph is a data structure that represents real-world entities as nodes and the relationships between them as edges. Both nodes and edges carry typed properties. The shape is purpose-built for the multi-hop questions analysts actually ask — "show me everything connected to X within N steps along these specific relationships."
Model Context Protocol (MCP)
Model Context Protocol (MCP) is an open standard introduced by Anthropic in late 2024 that lets AI assistants connect to external tools and data sources through a uniform interface. Instead of every model integrating every tool one by one, an MCP server exposes its capabilities and any MCP-aware client — Claude Desktop, Cursor, VS Code, custom agents — can use them.
Prompt Injection
Prompt injection is an attack that smuggles malicious instructions into the text an AI model reads, hijacking its behaviour. In agentic systems it extends to tool poisoning — corrupting the data a tool returns so the agent acts on attacker-controlled input. OWASP ranks goal hijacking the top risk for agentic applications.