llms.txt
+12 −12
https://www.whisper.security/llms.txt
− Last updated: 2026-10-08. Last verified against the live site: 2026-09-26. Graph figures measured: 2026-10-08 (source: https://graph.whisper.security GET /api/query/stats).− - [Anycast DNS-Root Sovereignty](https://www.whisper.security/docs/workflows/anycast-dns-root-sovereignty.md): Only in Whisper. Could a country still resolve names if it were isolated? This assesses a nation's DNS-root resilience — how many of the core root servers have a copy inside its borders, and who operates them — the sovereignty read for national-resilience and policy analysis.− - [Attack-Surface Mapper](https://www.whisper.security/docs/workflows/attack-surface.md): Faster in Whisper. See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.− - [BGP Hijack & Routing-Hygiene Audit](https://www.whisper.security/docs/workflows/bgp-hijack-exposure.md): Only in Whisper. Routing security you can act on. This grades a network on the conflicts and gaps that make route hijacking possible, then traces any conflict to the specific domains and organisations exposed on the affected blocks. An adversarial audit — not just a profile — for finding where a hijack could hurt and who it would hit.− - [Takedown Evidence Package](https://www.whisper.security/docs/workflows/build-takedown-evidence-package.md): Faster in Whisper. When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package — the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it — laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.− - [Threat Investigation](https://www.whisper.security/docs/workflows/indicator.md): Faster in Whisper. The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick chec− - [Digital Infrastructure Mapping](https://www.whisper.security/docs/workflows/infrastructure-mapping.md): Only in Whisper. Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner — even behind privacy WHOIS and CDNs — via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes − - [Nameserver & DNS Delegation Audit](https://www.whisper.security/docs/workflows/nameserver-hijack-dns-consistency.md): Only in Whisper. Your name servers decide where your domain points — and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts — so you can catch delegation weakness before it's exploited.− - [Subdomain Takeover Detection](https://www.whisper.security/docs/workflows/subdomain-takeover.md): Only in Whisper. A dangling subdomain — one still pointing at a service you've since torn down — is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.− - [Typosquat & Brand-Impersonation Scanner](https://www.whisper.security/docs/workflows/typosquat.md): Only in Whisper. Someone registering a look-alike of your domain usually isn't doing it for fun. This finds the registered impersonations of a brand — across misspellings and risky extensions — checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-alikes into a− - [Supply-Chain Dependency Mapping](https://www.whisper.security/docs/workflows/supply-chain.md): Only in Whisper. Maps every external provider a domain depends on — nameservers, mail exchangers, third-party email senders (SPF), CDN and hosting networks, registrar and DKIM vendors — by reading each layer of the graph and keeping only providers whose registrable apex differs from the target’s own. Each dependency is grouped by function and the flow flags single-vendor concentration: one DNS opera− - [Email Security Posture](https://www.whisper.security/docs/workflows/email-security-posture.md): Only in Whisper. Reads a domain’s SPF, DKIM, DMARC, MX and DNSSEC records straight off the graph and grades each on presence and hygiene: whether the control is configured, whether the SPF chain stays inside the ten-lookup limit, whether an SPF_IP authorization is unusually wide, whether a DKIM signer has no matching SPF authorization, and whether a mail-exchange address carries a threat verdict. N+ Last updated: 2026-10-16. Last verified against the live site: 2026-09-26. Graph figures measured: 2026-10-16 (source: https://graph.whisper.security GET /api/query/stats).+ - [Anycast DNS-Root Sovereignty](https://www.whisper.security/docs/workflows/anycast-dns-root-sovereignty.md): Only in Whisper. Could a country still resolve names if it were isolated? This assesses a nation's DNS-root resilience (how many of the core root servers have a copy inside its borders, and who operates them), the sovereignty read for national-resilience and policy analysis.+ - [Attack-Surface Mapper](https://www.whisper.security/docs/workflows/attack-surface.md): Faster in Whisper. See your organisation the way an attacker does. Give it a domain and it maps the full external footprint (every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to) and scores the exposure. The starting point for shrinking what's reachable from the outside.+ - [BGP Hijack & Routing-Hygiene Audit](https://www.whisper.security/docs/workflows/bgp-hijack-exposure.md): Only in Whisper. Routing security you can act on. This grades a network on the conflicts and gaps that make route hijacking possible, then traces any conflict to the specific domains and organisations exposed on the affected blocks. An adversarial audit, not just a profile, for finding where a hijack could hurt and who it would hit.+ - [Takedown Evidence Package](https://www.whisper.security/docs/workflows/build-takedown-evidence-package.md): Faster in Whisper. When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package (the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it), laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.+ - [Threat Investigation](https://www.whisper.security/docs/workflows/indicator.md): Faster in Whisper. The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint (the related domains, the real servers behind any CDN, the neighbouring infrastructure) and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check + - [Digital Infrastructure Mapping](https://www.whisper.security/docs/workflows/infrastructure-mapping.md): Only in Whisper. Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner (even behind privacy WHOIS and CDNs) via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes th+ - [Nameserver & DNS Delegation Audit](https://www.whisper.security/docs/workflows/nameserver-hijack-dns-consistency.md): Only in Whisper. Your name servers decide where your domain points, and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts, so you can catch delegation weakness before it's exploited.+ - [Subdomain Takeover Detection](https://www.whisper.security/docs/workflows/subdomain-takeover.md): Only in Whisper. A dangling subdomain, one still pointing at a service you've since torn down, is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.+ - [Typosquat & Brand-Impersonation Scanner](https://www.whisper.security/docs/workflows/typosquat.md): Only in Whisper. Someone registering a look-alike of a domain usually isn't doing it for fun. This finds the look-alike names of a brand that the graph has seen (across misspellings and risky extensions), checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-al+ - [Supply-Chain Dependency Mapping](https://www.whisper.security/docs/workflows/supply-chain.md): Only in Whisper. Maps every external provider a domain depends on (nameservers, mail exchangers, third-party email senders named in SPF, CDN and hosting networks, registrar and DKIM vendors) by reading each layer of the graph and keeping only providers whose registrable apex differs from the target’s own. Each dependency is grouped by function and the flow flags single-vendor concentration: one DNS + - [Email Security Posture](https://www.whisper.security/docs/workflows/email-security-posture.md): Only in Whisper. Reads a domain’s SPF, DKIM, DMARC, MX and DNSSEC records straight off the graph and grades each on presence and hygiene: whether the control is configured, whether the SPF chain stays inside the ten-lookup limit, whether an SPF_IP authorization is unusually wide, whether a DKIM signer has no matching SPF authorization, and whether a mail-exchange address carries a threat verdict. N
