Question 1

What is whobelooking?

Accepted Answer

whobelooking is a visitor intelligence platform that tells you which companies are silently evaluating your website. It uses reverse DNS, /24 neighbor scanning, RDAP whois lookups, and an enrichment cache to identify corporate visitors by IP. Every report is manually reviewed by a USCYBERCOM operator. It accepts any IP source: Cloudflare, access logs, CSV, or JSON.

Question 2

How does whobelooking work?

Accepted Answer

You provide traffic data (Cloudflare credentials, server access logs, or CSV). whobelooking runs each IP through reverse DNS, /24 network neighbor scanning, RDAP whois lookups, and company identification. Results are cached in an enrichment database that gets smarter with every report. A USCYBERCOM operator reviews the output and delivers a PDF intelligence report with company identifications, behavioral analysis, threat detection, and recommendations.

Question 3

How much does whobelooking cost?

Accepted Answer

Pricing scales with traffic volume. Starter: $150 for sites with under 500 unique IPs/week. Growth: $350 for 500-2,000 IPs. Scale: $750 for 2,000-10,000 IPs. Custom: $1,500+ for 10,000+ IPs. Every report is manually reviewed. Government purchase cards accepted (all tiers under $10K micro-purchase threshold).

Question 4

What is the enrichment flywheel?

Accepted Answer

Every report caches IP-to-company mappings in the enrichment database. When whobelooking resolves that 74.179.x.x belongs to Microsoft, that mapping helps every future customer. The more reports run, the more IPs are resolved, the faster and more accurate every report becomes. Early customers build the database and get early adopter pricing.

Question 5

Can whobelooking detect threats?

Accepted Answer

Yes. whobelooking identifies attack probes (such as attempts to access .env files, .aws/credentials, .git/config, or other sensitive paths), attributes them to specific organizations via whois, and can recommend Cloudflare firewall blocks. In one real case, a targeted attack from Spain probing AI developer environments was detected, attributed, and the entire /24 was blocked in under 10 minutes.

Question 6

What data sources does whobelooking accept?

Accepted Answer

whobelooking is platform-agnostic. It accepts: Cloudflare zone credentials (Zone ID + read-only API token), server access logs (nginx, Apache, Caddy), CSV files (ip, path, timestamp columns), and JSON arrays. Vercel and Netlify API integrations are planned.

Question 7

Who reviews the reports?

Accepted Answer

Every report is manually reviewed by Michael Cochran — Army 17C (Cyber Operations), USCYBERCOM J38 JMOC-E development lead, 13 years defense and enterprise experience. Automation is gated behind a creator certification process: the AI analysis must match the creator's manual results at 90%+ accuracy before being allowed to run unsupervised.

Question 8

Is whobelooking related to KNOXAI?

Accepted Answer

whobelooking is one of seven products in The Cochran Block portfolio, all built on the same zero-cloud Rust architecture. KNOXAI is the AI model certification platform. whobelooking provides visitor intelligence. Both share the same enrichment pipeline, the same Diamond Rust Binary build discipline, and the same operator. The enrichment cache feeds into KNOXAI's threat detection capabilities.