Resources
Read the research,
run it yourself.
Threat research and comparison data from the Whisper team. Below it, the tools that work on the graph and the free Whisper Projects built on it.
Start here
Research the team publishes, and the tools it ships in the open.
Blog
Investigations and teardowns from the team that runs the graph. New posts range from threat research to what shipped that month.
Threat IntelligenceProduct UpdatesInvestigationsIndustry NewsExplore
White papers
Long-form research on internet infrastructure and the threats that run on it. Each report cites its sources and states its method.
Research ReportsThreat AnalysisMethodologyCase StudiesExplore
Glossary
Plain-language definitions of the infrastructure and threat-intel terms that come up in real investigations, from DNSSEC to fast-flux DNS, and how each one shows up in the graph.
Explore
Feature comparison
Three tables measuring Whisper against infrastructure, threat-intel, endpoint and identity tools, cell by cell. Every mark cites the vendor’s own documentation and the date it was read.
Infrastructure & Threat IntelEndpoint & Egress ControlMachine IdentitySourced Per RowExplore
Open source
The CLI and SDKs Whisper ships, public on GitHub, plus the connectors and agent adapters that plug WhisperGraph into the rest of your stack. Install what you need, or read the source first.
CLI & SDKsYour StackYour AgentDevices & BrowserExplore
Infrastructure Security Blog
Stay up to date with the latest insights on infrastructure intelligence, threat hunting, and cybersecurity research from the Whisper Security team.
Prince of Persia: mapping the backend, and a reserve of domains staged for what comes next
An investigation into Prince of Persia’s backend infrastructure, revealing a previously unreported server, 58 dormant domains, and DNS patterns that can expose potential C2 infrastructure before activation.
The infrastructure you depend on but don't own
A single DNSSEC failure at Germany’s .de registry made millions of domains unreachable. The outage shows how infrastructure you don’t own can still become part of your attack surface
What an ASN actually is
Every IP belongs to an Autonomous System. Understanding ASNs is the first step to uncovering infrastructure relationships, tracing attacks, and investigating the internet beyond individual domains.
Every World Cup Threat Report Is a Starting Point
World Cup phishing campaigns are already scaling before kickoff. Whisper’s MCP turns public threat reports into actionable infrastructure investigations by uncovering the domains, hosting, DNS, and relationships hiding one layer deeper.
Concentration risk: when half the internet depends on three companies
Modern infrastructure looks distributed—but often isn’t. Hidden dependencies across cloud providers, DNS, and routing create concentration risk that most organisations can’t see until systems fail together
Your AI agent is only as smart as what it can see
AI agents don’t fail because of reasoning—they fail because of missing context. Without structured, connected infrastructure data, they can’t see the relationships that turn lookups into real investigations
White Papers & Reports
Download in-depth research and technical reports on infrastructure intelligence, DNS security, BGP monitoring, and threat detection from Whisper Security.
Six Domains in Eight Seconds: A World Cup 2026 Phishing Investigation
A World Cup 2026 threat investigation: six FIFA lookalikes registered in eight seconds, and how a single monitoring lead expanded into a nine-domain phishing cluster.
Read the report
Iran Internet Blackout - A Forensic Analysis
A real-time forensic analysis of the nationwide internet blackout in Iran. We present evidence of a coordinated, state-level shutdown, detailing the methods used to sever connectivity for 90 million people and exposing the anatomy of digital authoritarianism.
Read the report
The State of DNSSEC 2025
A comprehensive analysis of DNSSEC adoption across 200+ million domains reveals that while adoption is growing, the vast majority of the internet remains vulnerable to DNS-based attacks. This report details the current landscape, key growth trends, and the critical role of infrastructure providers.
Read the report
Tools
Work with WhisperGraph and Whisper Graph XDR directly. Some need a free account, some need nothing at all.
Whisper Console
The graph, explorable.
Explore WhisperGraph visually, run Cypher queries and prepared workflows, and manage your API keys, all in one place.
Sign in freeExplore the Console
Whisper Atlas
The internet's infrastructure, mapped.
Fly from submarine cables and landing stations down to a city's data centers and the address blocks inside them. Search a domain, an address or a network to see where it lives.
Sign in freeOpen Atlas
Graph XDR console
The operator console for Whisper Graph XDR.
Run Whisper Graph XDR across a fleet from one screen: identities, policy, incidents and the campaigns behind them. Every endpoint and agent carries its own routable IPv6 identity that anyone can verify.
Sign inOpen the Graph XDR console
Whisper Guard
A verdict on every site you open.
A browser extension that puts a mark in your toolbar on every page. It checks the site's name against imitated brands on your device, then against the Whisper graph. Only the hostname ever leaves your browser.
No sign-in neededAdd to ChromeAdd to Firefox
Whisper Projects
Free public services the Whisper team runs on the same graph. None of them needs a sign-in.
Whisper Internet Directory
A citable page for every host and network.
The Whisper Internet Directory gives the hostnames and networks on the graph a stable page you can cite: a plain summary, the threat posture and a nutrition label. Bookmark one, or link it from a report.
No sign-in neededBrowse the directory
isitsc.am
Paste an email, get a verdict.
Paste a suspicious email and get a plain-English verdict in seconds, with every signal behind the score listed. The page reads the email's infrastructure off the Whisper graph and stores nothing.
No sign-in neededCheck an email
Lookalikes
The domains that fool your browser.
Type a brand and see which look-alike domains of it are already registered, drawn in the address-bar fonts Chrome, Safari and Edge really use and checked live against the Whisper graph. The letter pairs behind it are free to download.
No sign-in neededCheck a brand
