Map a blast radius

Shared infrastructure is the exposure the perimeter never shows you

Inside a network, blast radius is familiar: if this host falls, what else can the attacker reach? Segments, ACLs, and trust relationships bound the answer. On the open internet the same question has a different answer, and a different threat model.

On shared hosting, one IP address can front around 18 separate organisations. Compromise one and its neighbours share the same address, the same upstream routes, the same nameservers. A university health portal might sit next to a few small businesses and a hobby blog, none of them aware of the others. Whoever controls the infrastructure sees every tenant; each defender sees only their own.

That cross-tenant exposure is invisible to any tool that treats an IP as single-tenant. Whisper maps it. From one seed asset, a query expands to every hostname co-hosted on its IP, the adjacent IPs those tenants also use, and the ASN that routes the whole prefix. That is the external blast radius: everything a shared-infrastructure compromise touches beyond the first victim.

What a bounded traversal returns

A query starts from a known seed — a compromised IP, a suspect domain, an indicator from an alert — and expands one hop at a time. The first hop finds every hostname resolving to the same IP: the co-tenants. The second follows those tenants to any other IPs they resolve to, showing the wider footprint the campaign touches. A third reaches the announced prefix and ASN for the routing context that ties the cluster together.

Every layer is bounded. The query returns counts and samples rather than unbounded result sets, so a dense shared-hosting IP with thousands of neighbours won't flood the response. You get a legible shape — how many co-tenants, how many secondary IPs, which network — instead of an overwhelming flat list.

Why it beats a flat reverse-IP lookup

A reverse-IP lookup lists the domains on one IP. A blast-radius traversal goes three steps further. It follows the co-tenants to their other IPs, so a suspect domain that also lives on a second IP shows up. It joins the routing layer, so the owning ASN and its peers are part of the result. And it carries the threat layer, so each neighbour and each new IP arrives with its own explain() verdict. That turns a list of neighbours into a ranked set of findings — the move from enumeration to triage.