Digital Infrastructure Mapping
One indicator, mapped to its real owner and full footprint. The run infers who actually operates it (even behind privacy WHOIS), pivots to the rest of that owner’s estate, and traces every layer below: subdomains and DNS/mail providers, the addresses and network that route it, where it physically sits, and the cloud and vendors behind it — then grades how concentrated the whole footprint is.
- Operated by Cloudflare (cdn)
- Owner runs 1,000+ other domain(s) under the same registrant
- Footprint concentrated on a single network (CLOUDFLARENET - Cloudflare, Inc.)
- Single network, but globally distributed (CDN-grade) — resilient
- Single jurisdiction (CA)
108 nodes · 156 edges
- cloudflare.com is operated by Cloudflare (cdn) — it acts as dns_operator, mail_receiver, origin_as, cdnidentify
- Registered to Cloudflare, Inc., Cloudflare Inc (canonicalised from WHOIS)WHOIS
- The same owner registered 1,000+ other domain(s) under noreply@data-protected.net, e.g. 3dv-lab.academy, 3dvlab.academy, 4man.academyWHOIS
- cloudflare.com's footprint is on a single network (CLOUDFLARENET - Cloudflare, Inc.) — globally distributed (CDN-grade)BGP
- Footprint sits in one jurisdiction (CA)GeoIP
- Serving addresses sit in Toronto, CAGeoIP
| service | provider | via |
|---|---|---|
| Operator | Cloudflare | cdn · DNS_OPERATOR · MAIL_RECEIVER · ORIGIN_AS · CDN |
| Registered owner | Cloudflare, Inc. | REGISTERED_BY |
| Registered owner | Cloudflare Inc | REGISTERED_BY |
| Registrar | iana:1910 | HAS_REGISTRAR |
| DNS | bella.ns.cloudflare.com | NAMESERVER_FOR |
| DNS | chelsea.ns.cloudflare.com | NAMESERVER_FOR |
| canonical name | vendor id | category | roles | host class |
|---|---|---|---|---|
| Cloudflare | cloudflare | cdn | DNS_OPERATORMAIL_RECEIVERORIGIN_ASCDN | unknown |
| organization | canonical org | registrar |
|---|---|---|
| cloudflare hostmastercloudflare, | Cloudflare, Inc.Cloudflare Inc | iana:1910 |
| registrant email | estate | sample |
|---|---|---|
| noreply@data-protected.net | 1000 | 3dv-lab.academy3dvlab.academy4man.academy6point6.academy360-flat.agency4fp.agency+2 more |
| domains@cloudflare.com | 258 | amp8ball.comas13335.comasap-cloudflare.comasapcloudflare.comasecureaccelerationprotocol.combaiduamp.com+2 more |
| registrant orgs | owned estate | estate sample |
|---|---|---|
| cloudflare hostmastercloudflare, | 500 | amp8ball.comas13335.comasap-cloudflare.comasapcloudflare.comasecureaccelerationprotocol.combaiduamp.com+2 more |
| subdomain count | sample |
|---|---|
| 5751 | 1.cloudflare.com1ns.cloudflare.com2.cloudflare.com_netblocks.cloudflare.com_spf.cloudflare.comaadens.cloudflare.com+6 more |
| apex | level1 count | level1 sample | level2 count | level2 sample | level3 count | level3 sample |
|---|---|---|---|---|---|---|
| cloudflare.com | 500 | 1.cloudflare.com1ns.cloudflare.com2.cloudflare.com_netblocks.cloudflare.com_spf.cloudflare.comaadens.cloudflare.com+2 more | 500 | annabel.1ns.cloudflare.comgateway.ai.cloudflare.comamp-reddit-com.amp.cloudflare.comdiscovery.amp.cloudflare.comes.amp.cloudflare.comesc-escortbayan997-com.amp.cloudflare.com+2 more | 167 | eventarte.es.amp.cloudflare.comvpc.staging.aws-flow-logs-federal.cloudflare.comamericasbps.com.cdn.cloudflare.comarup.com.cdn.cloudflare.compair.com.cdn.cloudflare.comdomain1.cloudy.click.cloudflare.com+2 more |
| subdomain | ip | prefix | registered prefix | asn | network | country |
|---|---|---|---|---|---|---|
| 1.cloudflare.com | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
| 1ns.cloudflare.com | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
| 2.cloudflare.com | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
| _netblocks.cloudflare.com | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
| _spf.cloudflare.com | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
| aadens.cloudflare.com | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
| nameservers | spf sources | |
|---|---|---|
| bella.ns.cloudflare.comchelsea.ns.cloudflare.comgraham.ns.cloudflare.comjerry.ns.cloudflare.comjim.ns.cloudflare.comjobs.ns.cloudflare.com | mxa.global.inbound.cf-emailsecurity.netmxa-canary.global.inbound.cf-emailsecurity.netmxb.global.inbound.cf-emailsecurity.netmxb-canary.global.inbound.cf-emailsecurity.net | _spf.google.comspf.mandrillapp.com_spf.salesforce.comstspg-customer.commail.zendesk.comspf1.mcsv.net |
| provider | host count | roles | sample |
|---|---|---|---|
| cf-emailsecurity.net | 4 | MX | mxa.global.inbound.cf-emailsecurity.netmxa-canary.global.inbound.cf-emailsecurity.netmxb.global.inbound.cf-emailsecurity.netmxb-canary.global.inbound.cf-emailsecurity.net |
| google.com | 1 | SPF | _spf.google.com |
| mcsv.net | 1 | SPF | spf1.mcsv.net |
| zendesk.com | 1 | SPF | mail.zendesk.com |
| stspg-customer.com | 1 | SPF | stspg-customer.com |
| salesforce.com | 1 | SPF | _spf.salesforce.com |
| ip | confidence | methods | asn | network | kind |
|---|---|---|---|---|---|
| 1.37.93.129 | 2 | links_to | AS4775 | GLOBE-TELECOM-AS - Globe Telecoms | origin |
| 1.37.93.136 | 2 | links_to | AS4775 | GLOBE-TELECOM-AS - Globe Telecoms | origin |
| 100.21.115.236 | 2 | links_to | AS16509 | AMAZON-02 - Amazon.com, Inc. | origin |
| 100.21.188.37 | 2 | links_to | AS16509 | AMAZON-02 - Amazon.com, Inc. | origin |
| 100.22.41.12 | 2 | links_to | AS16509 | AMAZON-02 - Amazon.com, Inc. | origin |
| 100.22.79.172 | 2 | links_to | AS16509 | AMAZON-02 - Amazon.com, Inc. | origin |
| ip | prefix | asn | network | country |
|---|---|---|---|---|
| 104.16.132.229 | 104.16.128.0/20 | AS13335 | CLOUDFLARENET - Cloudflare, Inc. | CA |
| 104.16.133.229 | 104.16.128.0/20 | AS13335 | CLOUDFLARENET - Cloudflare, Inc. | CA |
| ip | cotenants | capped | sample |
|---|---|---|---|
| 104.16.132.229 | 500 | true | c-cloudflare-com.4i.ammenuchin.appwww.menuchin.appqapy.com.arwildcard.cloudflare.atwildcard.cloudflare.co.at+2 more |
| 104.16.133.229 | 500 | true | c-cloudflare-com.4i.amwildcard.cloudflare.atwildcard.cloudflare.co.atm.auroraexpeditions.com.auwww.reignpropertyagents.com.auwildcard.cloudflare.biz+2 more |
| countries | cities |
|---|---|
| CA | Toronto, CA |
| asn | facilities | facility sample | ixps | peer count | rpki roas |
|---|---|---|---|---|---|
| AS13335 | 1488 | Equinix SV8 - Silicon Valley, Palo AltoEquinix SV1/SV5/SV10 - Silicon Valley, San JoseEquinix DA1 - DallasEquinix DC1-DC15,DC21-DC22 - AshburnDigital Realty SFO (200 Paul) | 215 | 1218 | 4890 |
| asn | prefixes | sampled | valid count | invalid count | unsigned count | invalid sample | unsigned sample |
|---|---|---|---|---|---|---|---|
| AS13335 | 500 | true | 328 | 0 | 172 | ∅ | 8.6.112.0/248.9.231.0/248.14.204.0/248.18.50.0/248.18.113.0/24 |
| asn | peer count | peer sample |
|---|---|---|
| AS13335 | 1218 | AS31AS49AS112AS174AS260AS577+2 more |
| facility | city | country | operator | assetAsnsHere | assetAsnSample | totalAsnsAtFacility | totalSaturated |
|---|---|---|---|---|---|---|---|
| 1530 SWIFT - NOCIX | North Kansas City | US | NOCIX, LLC | 1 | AS13335 | 500 | true |
| 165 Halsey Meet-Me Room | Newark | US | Tishman Real Estate Services | 1 | AS13335 | 500 | true |
| 3S Data Center Katowice | Katowice | PL | 3S S.A. | 1 | AS13335 | 500 | true |
| 4 Data Center | Katowice | PL | Quicktel Sp. z o.o. | 1 | AS13335 | 500 | true |
| AT TOKYO (CC1/CC2) | Tokyo | JP | AT TOKYO Corporation | 1 | AS13335 | 500 | true |
| AT TOKYO (CC3) | Tokyo | JP | AT TOKYO Corporation | 1 | AS13335 | 500 | true |
| cloud regions | vendors |
|---|---|
| ∅ | ∅ |
The one query behind this▾
CALL whisper.identify([$value]) YIELD host, vendor_id, canonical_name, category, roles, host_class RETURN canonical_name, vendor_id, category, roles, host_class LIMIT 5
Snapshot from a max-depth run on Jun 26, 2026. Run it again for live data. infrastructure-mapping
Free tier — no credit card. Runs up to 3 hops deep; Pro goes to 5.
What it solves
Mapping an organisation's real estate usually stalls at privacy WHOIS and never reaches the physical or cloud layer. This infers the owner and follows the footprint all the way down.
The run infers who actually operates the indicator, pivots to the rest of that owner's estate, and traces every layer below: subdomains and DNS/mail providers, the addresses and network routing it, where it physically sits, and the cloud and vendors behind it, then grades how concentrated the whole footprint is.
Six tools and an hour to draw one ownership map by hand.
- WHOIS
- passive DNS
- BGP tools
- cloud IP ranges
- a diagram
What this means
- Ownership is rarely one clean field. The real operator is inferred by stitching together identify, the canonicalised registrant, and the shared-email estate — so privacy WHOIS does not hide it.
- A footprint that fans across many networks, countries and facilities is resilient. One that collapses onto a single provider or jurisdiction is a concentration and sovereignty risk.
- The physical layer (datacenters, exchanges) turns an abstract footprint into the real places an outage or a seizure would actually land.
Dig deeper
Read the how-to
The documentation for this flow — the queries explained, with variants you can adapt.
Open the documentation →Related flows
All use cases →Enrich an ASN — routing, RPKI & physical footprint
One ASN in, and you get its announced prefixes, RPKI coverage, BGP peers, and the facilities and exchanges where it physically sits.
Route-Health Checker
Hand it a prefix or ASN and get a routing-integrity card: MOAS conflicts, RPKI coverage, prefix status, and footprint.
Attack-Surface Mapper
Point it at a domain and get the full external footprint, scored: subdomains, nameservers, mail senders, the origins behind any CDN, and the posture of everything that serves it.
Map an org’s infrastructure concentration risk
Measure how few networks an organisation's whole footprint actually rests on, the single-point-of-dependency read DORA asks for.
Find the real infrastructure behind the CDN
One passive call reconstructs the likely true origin IPs behind a CDN, with a confidence score for each candidate.
Attack Path Analysis
From one foothold, the structure an attacker would lean on: the choke points, the pivots that survive IP rotation, and how close it sits to known-bad.