Use cases
Attack surface & external recon
De-cloaking an origin behind a CDN or enumerating an org footprint usually means active scans — and active scans leak your intent and trip defenses. WhisperGraph maps the surface from passive data instead: every subdomain, resolving IP, and announcing ASN, with no packets sent.
You see the exposure an attacker would, including the shadow IT and forgotten infrastructure a clean asset inventory never shows.
Why this is hard without a graph
Recon tools answer one question each — a reverse-IP here, a subdomain brute-force there — and none of them join the results into a footprint. The hosting diversity that signals shadow IT, the origin hiding behind a proxy, the ASN that ties it all together: each is a separate, noisy lookup.
What changes with WhisperGraph
One hop-bounded query expands a domain to its whole footprint and keeps going where scanners stop — into the datacenters the network occupies and the routing a hijack would reach. Because it reads the graph, not the target, nothing on the other side ever sees you coming.
4 workflows in Attack surface & recon
Each one runs live on the graph — no signup.
Attack-Surface Mapper
See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.
Certificate Transparency Asset Discovery
Every HTTPS certificate is logged publicly — and that log is a goldmine for finding assets you forgot you had. This surfaces a domain's certificates (wildcards included), when they first and last appeared, and the sibling hostnames issued alongside them. A clean way to uncover shadow assets and expansion no inventory captured.
AI / Agent Infrastructure Discovery
AI endpoints are becoming their own attack surface. This maps an organisation's externally visible AI and agent infrastructure — the API, model, and agent hosts exposed to the internet — from the outside, with no cooperation needed. A best-effort first look at an emerging and often unmanaged part of the footprint.
Subdomain Takeover Detection
A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.