How is this different from the full Threat Investigation workflow?

This is the fast context card: who, where, and what’s attached. Threat Investigation is the deep dive that fans out across related infrastructure and returns a scored verdict.

Does it work on IPv6 addresses?

Yes. The indicator field accepts a hostname, an IPv4 or IPv6 address, an ASN or a CIDR prefix, and runs the same enrichment on each.

What does the reputation read actually check?

Threat-feed listings and network-level signals tied to the indicator and the infrastructure around it.

Can I see the physical location this indicator resolves to?

Yes, the physical footprint step surfaces the facility and country the hosting infrastructure sits in, where that data exists in the graph.

Only in WhisperDNS & email security

Who's really behind this domain or IP?

Turn one domain or IP into a full context card — owner, hosting, mail, location, and reputation at a glance.

Try:

Try this in Console

No credit card needed.

What it solves

Before deciding whether to escalate, block or ignore an indicator, an analyst usually needs a handful of quick facts scattered across WHOIS, DNS and a reputation tool. Pulling that context by hand for every indicator that crosses a queue is what actually eats analyst time, not the decision itself.

It reads registration identity and history from WHOIS, resolves the indicator’s role in the graph, walks its subdomains, name servers, mail servers and CNAME aliases, attributes it to a network and physical location, and checks reputation and vendor identity, all in one pass.

The old way4 tools / tabs

Building basic context on one indicator usually means several separate lookups before an analyst has enough to make a first call.

a WHOIS lookup
a DNS record checker
an IP-to-ASN tool
a reputation checker

What this means

Give it one domain or IP and it fills in who registered it, where it’s hosted, its mail and name servers, and the network behind it.
It returns a single context card crossing the WHOIS, DNS, email, BGP, TLS and threat-intel layers, built for a quick read before you decide what to do next.

Dig deeper

Key concepts

Read the how-to

What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.

Open the documentation

Why teams run this

The job this flow does, the failure mode it removes, and the proof it produces.

SOC and threat intel

Related flows

All use cases

Faster in Whisper

Threat Investigation

The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'

SOC, DFIR & IRDocs

Only in Whisper

Network & Routing Report

The full picture of how a network is put together and reaches the internet. Give it a network or address block and get a health card: what it announces, who it peers and buys transit from, whether it leans dangerously on a single upstream, and how well its routes are protected. The one-look report for network engineers assessing reach and resilience.

Network & BGPDocs