Technology

One graph of the whole internet.

Whisper takes the data that normally lives in a dozen separate tools — DNS, routing, ownership, threat intelligence, the physical layer — and joins it into a single graph you can query. One question can run from a domain all the way to the datacenter behind it.

7.4B
nodes
39.3B
edges
39
entity types
43
threat feeds

Read-only, queried in Cypher, answered in milliseconds. Counts are live from graph.whisper.security.

Why we built it

The answer was never in one place

Ask a real question about internet infrastructure — who actually runs this IP, what else shares its hosting, is the route it sits on authorized — and you end up in five tools at once. DNS in one, routing in another, ownership in a third, threat feeds in a fourth, and the physical layer almost nowhere. Each tool answers the question it was built for and nothing about the connections between them.

But the connections are the answer. A domain points to nameservers, which resolve to addresses, which belong to prefixes, which are announced by networks, which peer with other networks, which carry known-malicious infrastructure. The interesting questions in security are all relational, and a relationship is exactly what a flat lookup throws away.

So we pre-join it. Every layer of the internet lands in one graph, indexed so that a hop from DNS to routing to threat intelligence is as fast as a single lookup. You stop stitching tools together and start following the graph.

What's joined

Every layer, in one model

Ten domains of internet data, each one normally a product of its own, reachable in a single traversal.

DNS & hostnames

Resolution, CNAME chains, nameserver and mail delegation, and the parent–child hierarchy of every name down to the TLD.

IP addressing

IPv4 and IPv6 addresses, the prefixes they belong to, and the allocations behind them — addressing as first-class data, not strings.

BGP routing & ASNs

Which network announces an address, who it peers with, and where announcements conflict (the multi-origin signal behind route hijacks).

RPKI

Route Origin Authorizations joined to prefixes and origins, so you can ask whether a route is actually authorized — not just whether it exists.

WHOIS & ownership

Registrants, registrars, and the contact records that tie unrelated-looking domains back to a shared owner.

Geolocation

The city and country behind an address, joined to the network and facility that carry it.

Threat intelligence

Dozens of feeds and their categories, attached directly to the addresses, hostnames and networks they describe.

Threat actors & techniques

Named actors mapped to MITRE ATT&CK techniques, in the same graph as the infrastructure they use.

Email authentication

SPF reach, mail routing, and DMARC reporting — the sending posture of a domain, joined to the infrastructure behind it.

The physical internet

Data-center facilities, internet exchanges, submarine cables and their landings, CDN points of presence, and cloud regions.

The WhisperGraph capability map — DNS and the web, routing and BGP, RPKI and hijack signals, WHOIS ownership, email and GeoIP, threat intelligence and verdicts, threat actors and ATT&CK techniques, and the physical layer — all in one graph.
Every domain of internet data, joined into one graph — and reachable from any other.
What that unlocks

One query, across the stack

Anchor on a single name and follow it down — to the network that routes it, the city it sits in, and the facilities that carry it.

The query on the right starts at a hostname and crosses six layers without leaving the graph: DNS resolution, IP addressing, BGP routing, ownership, geolocation, and the physical facilities a network is present at. In a stack of separate tools, that’s an afternoon of copy-paste. Here it’s one statement.

That’s the whole idea of the platform. Pick any starting point — an alert, a domain, a network — and the graph already holds what connects to it. See what people do with it →

MATCH (h:HOSTNAME {name:"github.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:ANNOUNCED_BY]->(:ANNOUNCED_PREFIX)-[:ROUTES]->(a:ASN)
WITH h, ip, a LIMIT 1
OPTIONAL MATCH (ip)-[:LOCATED_IN]->(city)
CALL { WITH a MATCH (a)-[:AS_PRESENT_AT]->(f) RETURN collect(f.name)[0..3] AS facilities }
RETURN ip.name AS ip, a.name AS network, city.name AS city, facilities
Runnable against the live graph — anchor on any name and follow it down.
One query crossing every layer: a hostname resolves to an IPv4, announced by a prefix, routed by an ASN, present at a physical facility — DNS, addressing, BGP routing, autonomous system and physical layers in a single traversal.
The query above, drawn out — one path from a hostname down to the datacenter behind it.
Go deeper

The technology, in four parts

See it live

The fastest way to understand it is to run a query.

Explore use casesGet a free key