# Attack-Surface Mapper > See your organisation the way an attacker does. Give it a domain and it maps the full external footprint (every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to) and scores the exposure. The starting point for shrinking what's reachable from the outside. *Source: https://www.whisper.security/docs/workflows/attack-surface* --- ## What it solves Security teams rarely know their organisation’s full external footprint, because subdomains, SaaS delegations and CDN dependents accumulate for years, often outside the team that provisioned them. Shrinking what’s reachable from the outside starts with a footprint nobody has to build by hand. ## How it uses the graph Traverses the DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical layers of the graph, in 32 steps: 01. **Asset verdict** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Scoring the domain with the verdict read… 02. **Asset class** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Identifying the domain's vendor and class… 03. **Company** _(WHOIS)_ — Reading the company that owns the domain… 04. **Technologies** _(web)_ — Listing the technologies the domain runs… 05. **CT-log subdomains** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Mining CT logs for certificate-named subdomains… 06. **Nameservers** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Finding the domain's nameservers… 07. **Subdomain-takeover candidates** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Checking subdomains for CNAMEs that point at unclaimed names… 08. **Dangling delegations, count** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — How many subdomains the graph’s dangling-CNAME check reports, among up to 1,000 scanned. 09. **CNAME delegation targets** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Inventorying every CNAME (ALIAS_OF) delegation target the namespace makes… 10. **SaaS delegation: true count** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — How many subdomains delegate to a third-party platform, in total. 11. **Mail servers** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Finding the domain's mail servers… 12. **SPF authorized senders** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Reading the domain's SPF-authorised senders… 13. **DMARC reporting** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Reading the domain's DMARC report recipients… 14. **Registrar & registrant** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Reading registrar, registrant and email… 15. **Sibling domains (registrant-email pivot)** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Pivoting on the registrant email to co-registered domains… 16. **Look-alike / typosquat domains** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Enumerating registered look-alike domains… 17. **Candidate origins behind a CDN** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Looking for candidate origin addresses behind any CDN… 18. **Resolving IPs** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Resolving the apex to its IPs… 19. **Serving network (IP → ASN)** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Tracing serving IPs to ASN, country and threat… 20. **Cloud regions** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Mapping serving prefixes to their cloud region… 21. **Hosting-network reputation** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Assessing each serving ASN's reputation with the verdict read… 22. **Physical footprint** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Tracing serving ASNs to the datacenters they sit in… 23. **TLS fingerprints** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Collecting the serving IPs' TLS fingerprints… 24. **Neighborhood threat** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Counting flagged domains on the serving IPs… 25. **Subdomain count** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Counting the subdomains… 26. **Subdomain hosting map** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Subdomain hosting map… 27. **Hosting diversity** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Hosting diversity… 28. **Domains hosted on this ASN** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Domains hosted on this ASN… 29. **Branded name search** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Branded name search… 30. **Inbound web links** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Inbound web links… 31. **Outbound web links** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Outbound web links… 32. **Mutual web links** _(DNS, email, BGP, WHOIS, threat-intel, TLS, GeoIP, physical)_ — Mutual web links… ## Why each step runs 1. **Asset verdict.** Sets the headline threat verdict for the asset before the surface is enumerated, framing how risky the footprint is. 2. **Asset class.** Reads host-class and roles so a CDN or shared platform reads as structure rather than as an attacker-controlled asset. 3. **Company.** The company lookup names the organization behind the registrable domain: its legal name, industry and headquarters. A subdomain inherits its apex’s company. The company columns are a plan feature; without it the graph still says a company is linked and withholds the details, which the profile shows as not in your plan rather than as no data. 4. **Technologies.** RUNS_TECHNOLOGY lists the products detected on the registrable domain: the 100 most widely adopted, with the total detected, grouped by category in the profile. Adoption is a lead to confirm, not proof of exposure. Technology data is a plan feature; without it the step is refused and the profile says so. 5. **CT-log subdomains.** Reads CT_OBSERVATION names to recover subdomains that issued TLS certs: hosts DNS enumeration alone may miss. 6. **Nameservers.** Walks NAMESERVER_FOR (excluding root servers) to name the DNS operators the domain delegates to: its control-plane dependency. 7. **Subdomain-takeover candidates.** Lists subdomains whose CNAME points at a name the graph’s dangling-CNAME check reports as unclaimed. A candidate to verify, never a confirmed takeover; the check’s answer can differ between runs. 8. **Dangling delegations, count.** Counts every subdomain the check reports rather than the 50 that fit in the sample. A count of zero means the graph reported nothing, not that the estate is safe. 9. **CNAME delegation targets.** Walks every subdomain's ALIAS_OF target to inventory every CNAME delegation the namespace makes. Most rows are first-party infrastructure aliases (e.g. a domain's own edge/CDN names), not third-party SaaS. The row count overstates the true supply-chain surface, so read this as a delegation inventory, not a SaaS count. `target_ips` is the resolved IPv4 count for the CNAME target; it is not a takeover signal on its own; see subdomain-takeover for the dedicated dangling-CNAME check. 10. **SaaS delegation: true count.** The delegation list is capped at 50 rows. Counting the rows counts the cap, not the dependencies, so the total is measured separately and never truncated. 11. **Mail servers.** Walks MAIL_FOR to surface the mail exchangers, part of the email attack surface and a spoofing/relay consideration. 12. **SPF authorized senders.** Enumerates every SPF mechanism (include/ip/a/mx/exists/redirect) and its target, the full set of hosts allowed to send as the domain. 13. **DMARC reporting.** Surfaces the DMARC_REPORTS_TO recipients, indicating whether email-authentication reporting is configured and where it lands. 14. **Registrar & registrant.** Captures the WHOIS ownership trail (registrar, organisation, contact email), the human/legal layer of the surface. 15. **Sibling domains (registrant-email pivot).** Pivots on the apex's WHOIS registrant email to the other domains it registered (privacy/role addresses excluded, expansion capped per email so a shared address can't explode): the org-expansion step the single-domain pass skips. HIGH-confidence only when the email is exact and the portfolio is small; corroborate before trusting. 16. **Look-alike / typosquat domains.** Generates typo/homoglyph variants of the apex and keeps only the REGISTERED ones: the brand/typosquat surface. Most are owned by unrelated parties; score each before alerting. 17. **Candidate origins behind a CDN.** Runs the origin lookup for candidate server addresses behind any CDN. They are unconfirmed: in our audit, 6 of 71 checked candidates were the origin. 18. **Resolving IPs.** Pins the addresses the domain resolves to, the anchor the serving-network, TLS and threat steps all key off. 19. **Serving network (IP → ASN).** Resolves IP→prefix→ASN with country and IP threat flags, naming the network that serves the domain and its reputation. 20. **Cloud regions.** Maps each serving prefix to its CLOUD_REGION (e.g. aws:eu-west-1), exact data-residency and blast-radius the country-level GeoIP alone misses. 21. **Hosting-network reputation.** Runs the verdict read on each serving ASN for its neighborhood reputation: a high-abuse hosting network is a real signal the per-IP threat view misses, even when the domain's own IPs are clean. 22. **Physical footprint.** Walks AS_PRESENT_AT to the physical facilities the serving ASN occupies: the supply-chain/physical layer no outside-in scanner can reach. Live on prod: a serving ASN can carry from a handful up to well over a thousand facilities (e.g. 45 for AS36459, 1,154 for AS8075), often the richest layer in the run. 23. **TLS fingerprints.** Reads EMITS_TLS_FINGERPRINT to capture each address's TLS stack signature, a clustering and posture signal across the surface. 24. **Neighborhood threat.** Measures how many co-tenants on the domain's own IPs are already threat-listed: how risky the hosting neighbourhood is. 25. **Subdomain count.** The subdomains published directly beneath the domain, each name counted once, up to 100,000. The canvas draws the count beside the domain; a name two levels down is counted under its own parent. 26. **Subdomain hosting map.** Ties each subdomain to the IP, prefix and network that host it, showing exactly where the externally exposed surface lives. 27. **Hosting diversity.** Counts how many subdomains sit on each hosting network, showing whether the footprint is concentrated on one provider or spread across many. 28. **Domains hosted on this ASN.** When the input is an ASN, enumerates the domains living inside that network's address space so the surface can be mapped network-first. 29. **Branded name search.** Surfaces every registered hostname that begins with the given string, catching related or brand-impersonating names outside the direct subdomain tree. 30. **Inbound web links.** Lists the sites that hyperlink to the domain, mapping its inbound web-link graph and who references it. 31. **Outbound web links.** Shows which external sites the domain links out to, part of its web-facing surface and third-party exposure. 32. **Mutual web links.** Finds reciprocal hyperlinks between the domain and its peers, which often signal partnerships or affiliations worth investigating. [Open the full use-case page, with the live runner](/products/intelligence/use-cases/attack-surface-recon/attack-surface)