The Engine

We built the graph engine ourselves.
Nothing off the shelf could hold this.

47.1B data points. Sub-millisecond traversal. One server. This page explains how, in enough detail that an engineer can tell whether we are serious.

Why not a normal graph database.

The honest answer is that we tried. General purpose graph databases store a generic node with a generic property bag, and pay for that generality on every hop. At internet scale, where the interesting answers are four and five hops out, that cost is the difference between a query and a coffee break.

So the engine models internet objects natively. A prefix knows it is a prefix. An autonomous system knows what it announces. A certificate knows every name it covers. The traversal never has to ask what it is holding.

How the storage works.

Choice
Compressed sparse row adjacencyA node's neighbours sit contiguous in memory, so a hop is a sequential read rather than a pointer chase
Off-heap memory, managed directlyNo garbage collection on the query path at all
Delta and variable-length integer edge encodingThe graph fits in memory that would otherwise hold a fraction of it
A separate mutable overlay for writes, merged periodicallyIngest never blocks reads
A prefix index for names, a trie for addressesText search and CIDR containment are first class, not bolted on

How the queries work.

Cypher, properly. A real lexer and parser, a planner that pushes type predicates down and rewrites scans into index lookups, and compiled row iterators that allocate nothing per row. Plans cached in two tiers.

It is not a translation layer over something else. Which matters, because the moment your queries get interesting is the moment a thin wrapper stops keeping up.

Freshness, and honesty about it.

Layer
BGP routingLive stream
Certificate transparencyContinuous
Threat feedsContinuous per source, with published health per connector
WHOIS and RDAPRolling bulk refresh
DNSContinuous, newly observed domains near real time
Physical infrastructurePeriodic, from registry and operator sources

Every connector reports its own health. When a source is behind, the answer says so rather than quietly ageing.

46B+
data points of internet infrastructure
Fact
Native entity types40
Threat feed connectors93
Countries covered190+
Typical traversalUnder a millisecond
FootprintA single server, not a cluster you have to operate

We run the network we are telling you about.

Whisper operates AS219419, allocated by RIPE, RPKI signed, MANRS compliant. Our advisory board includes the Chief Scientist of APNIC, the President of the Internet Systems Consortium, and a former Chair of the ICANN Board.

That combination is the answer to the only question that really matters about a data product, which is why you should believe the data.

See the advisory board

Run a query
against it.