Cypher Query Guide

BASE=https://graph.whisper.security
API_KEY=YOUR_API_KEY

curl -s -X POST $BASE/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $API_KEY" \
  -d '{"query": "MATCH (h:HOSTNAME {name: \"www.google.com\"})-[:RESOLVES_TO]->(ip:IPV4) RETURN h.name, ip.name"}'

{
  "columns": ["h.name", "ip.name"],
  "rows": [
    {"h.name": "www.google.com", "ip.name": "142.250.64.100"},
    {"h.name": "www.google.com", "ip.name": "142.251.150.119"},
    {"h.name": "www.google.com", "ip.name": "142.251.151.119"},
    {"h.name": "www.google.com", "ip.name": "142.251.152.119"},
    {"h.name": "www.google.com", "ip.name": "142.251.153.119"},
    {"h.name": "www.google.com", "ip.name": "142.251.154.119"},
    {"h.name": "www.google.com", "ip.name": "142.251.155.119"},
    {"h.name": "www.google.com", "ip.name": "142.251.156.119"},
    {"h.name": "www.google.com", "ip.name": "142.251.157.119"}
  ],
  "statistics": {"rowCount": 9, "executionTimeMs": 6}
}

curl -s -X POST $BASE/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $API_KEY" \
  -d '{"query": "MATCH (n:ASN) RETURN n.name LIMIT 3"}'

{
  "columns": ["n.name"],
  "rows": [{"n.name": "AS1"}, {"n.name": "AS10"}, {"n.name": "AS100"}],
  "statistics": {"rowCount": 3, "executionTimeMs": 3}
}

curl -s -H "X-API-Key: $API_KEY" \
  "$BASE/api/query?q=RETURN%201%20%2B%201%20AS%20result"

curl -s -H "X-API-Key: $API_KEY" $BASE/api/query/stats

{
  "nodeCount": 3600000000,
  "edgeCount": 26000000000,
  "threatIntel": {
    "threatIntelLoaded": true,
    "hasTaxonomy": true,
    "feedSourceCount": 40,
    "categoryCount": 18,
    "totalListedInEdges": 3900000,
    "asnEnrichmentLoaded": true,
    "prefixBgpEnrichmentLoaded": true,
    "available": true
  },
  "timestamp": "2026-01-01T00:00:00.000000000Z"
}

{
  "message": "Unexpected token 'INVALID', expected MATCH/RETURN/WITH/UNWIND/CALL at position 0",
  "error": "CypherParseException",
  "timestamp": "2026-01-01T00:00:00.000000000Z"
}

-- Lookup by exact name
MATCH (h:HOSTNAME {name: "www.google.com"}) RETURN h.name

-- Traverse a single relationship
MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
RETURN ip.name

-- Multi-hop traversal: hostname → IP → prefix → ASN → ASN name
MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:BELONGS_TO]->(p:PREFIX)<-[:ROUTES]-(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN h.name, ip.name, p.name, a.name, n.name

-- Enrich nameservers with their IP addresses
MATCH (h:HOSTNAME {name: "google.com"})<-[:NAMESERVER_FOR]-(ns:HOSTNAME)
OPTIONAL MATCH (ns)-[:RESOLVES_TO]->(ip:IPV4)
RETURN ns.name, ip.name

-- Test for missing data (null padding)
MATCH (h:HOSTNAME {name: "www.google.com"})
OPTIONAL MATCH (h)-[:SIGNED_WITH]->(alg:DNSSEC_ALGORITHM)
RETURN h.name, alg.name

MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
WHERE ip.name <> "0.0.0.0"
RETURN ip.name

-- STARTS WITH: fast indexed prefix search
MATCH (h:HOSTNAME) WHERE h.name STARTS WITH "www.google"
RETURN h.name LIMIT 5

-- ENDS WITH: fast for domain suffix patterns (must start with ".")
MATCH (h:HOSTNAME) WHERE h.name ENDS WITH ".google.com"
RETURN h.name LIMIT 5

-- CONTAINS: full-text search
MATCH (h:HOSTNAME) WHERE h.name CONTAINS "cloudflare"
RETURN h.name LIMIT 5

MATCH (h:HOSTNAME)
WHERE h.name =~ "www\.google\.[a-z]{2,3}"
RETURN h.name LIMIT 5

MATCH (h:HOSTNAME)
WHERE h.name STARTS WITH "www.google" AND NOT h.name ENDS WITH ".com"
RETURN h.name LIMIT 3

MATCH (h:HOSTNAME {name: "www.google.com"})
OPTIONAL MATCH (h)-[:SIGNED_WITH]->(alg:DNSSEC_ALGORITHM)
RETURN h.name, alg IS NULL AS hasNoDNSSEC

MATCH (n:COUNTRY)
WHERE n.name IN ["US", "DE", "AU"]
RETURN n.name

MATCH (h:HOSTNAME {name: "www.google.com"})
RETURN h.name AS hostname, size(h.name) AS nameLength, labels(h) AS nodeLabels

MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:BELONGS_TO]->(p:PREFIX)
RETURN DISTINCT p.name

WITH 1 AS x RETURN x

WITH 'hello' AS greeting, 42 AS answer RETURN greeting, answer

-- WITH + UNWIND
WITH [1, 2, 3] AS nums UNWIND nums AS n RETURN n

-- WITH + arithmetic (requires parentheses)
WITH (2 + 3) AS total RETURN total

MATCH (a:ASN {name: "AS13335"})-[:ROUTES]->(p:PREFIX)
WITH a, count(p) AS cnt
RETURN a.name, cnt

MATCH (a:ASN {name: "AS15169"})-[:HAS_NAME]->(n:ASN_NAME)
MATCH (a)-[:HAS_COUNTRY]->(c:COUNTRY)
RETURN a.name, n.name, c.name

MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
WITH h, ip
MATCH (ip)-[:BELONGS_TO]->(p:PREFIX)
RETURN h.name, ip.name, p.name

-- Arithmetic chain
WITH 1 AS x WITH x + 1 AS y RETURN y

-- String concatenation chain
WITH 'hello' AS a WITH a + ' world' AS b RETURN b

-- Triple chain
WITH 1 AS x WITH x + 1 AS y WITH y * 10 AS z RETURN z

-- Parameterized hostname lookup
WITH 'www.google.com' AS hostname
MATCH (h:HOSTNAME {name: hostname})
RETURN h.name

-- With traversal
WITH 'AS13335' AS asnName
MATCH (a:ASN {name: asnName})-[:HAS_NAME]->(n:ASN_NAME)
RETURN a.name, n.name LIMIT 5

MATCH (n:COUNTRY) RETURN n.name ORDER BY n.name ASC LIMIT 5

MATCH (c:COUNTRY)<-[:HAS_COUNTRY]-(a:ASN)-[:ROUTES]->(p:PREFIX)
WITH c.name AS country, count(DISTINCT a) AS asn_count
RETURN country, asn_count ORDER BY asn_count DESC LIMIT 5

-- SKIP must come before LIMIT
MATCH (n:RIR) RETURN n.name SKIP 2 LIMIT 3

UNWIND [1, 2, 3] AS x
RETURN x, x * 2 AS doubled

-- UNWIND values used as property lookup keys (O(1) index lookup per element)
UNWIND ["AS13335", "AS15169"] AS asn
MATCH (a:ASN {name: asn})
RETURN a.name

UNWIND ["AS13335", "AS15169"] AS asn
MATCH (a:ASN {name: asn})-[:HAS_NAME]->(n:ASN_NAME)
RETURN a.name, n.name

-- UNWIND + MATCH with multi-hop traversal
UNWIND ['www.google.com', 'cloudflare.com'] AS h
MATCH (n:HOSTNAME {name: h})-[:RESOLVES_TO]->(ip:IPV4)
RETURN n.name, ip.name

MATCH (h:HOSTNAME {name: "www.google.com"}) RETURN h.name AS name
UNION
MATCH (h:HOSTNAME {name: "www.cloudflare.com"}) RETURN h.name AS name

MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
CALL { WITH ip MATCH (ip)-[:BELONGS_TO]->(p:PREFIX) RETURN p }
RETURN ip.name, p.name

-- Multi-hop subquery with full chain
MATCH (h:HOSTNAME {name: "cloudflare.com"})-[:RESOLVES_TO]->(ip:IPV4)
CALL { WITH ip MATCH (ip)-[:BELONGS_TO]->(p:PREFIX)<-[:ROUTES]-(a:ASN) RETURN p, a }
RETURN ip.name, p.name, a.name

-- Subquery with aggregation (each outer row gets independent aggregation)
UNWIND ['www.google.com', 'cloudflare.com'] AS h
CALL { WITH h MATCH (n:HOSTNAME {name: h})-[:RESOLVES_TO]->(ip:IPV4) RETURN count(ip) AS cnt }
RETURN h, cnt

EXPLAIN MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
RETURN ip.name

MATCH (h:HOSTNAME {name: "www.google.com"})
RETURN CASE WHEN h.name STARTS WITH "www" THEN "subdomain" ELSE "apex" END AS type

-- Multi-branch CASE
MATCH (h:HOSTNAME {name: "www.google.com"})
RETURN h.name,
  CASE
    WHEN size(h.name) > 10 THEN "long"
    WHEN size(h.name) > 5 THEN "medium"
    ELSE "short"
  END AS length_class

MATCH p = shortestPath(
  (h:HOSTNAME {name: "www.google.com"})-[*1..5]->(a:ASN {name: "AS15169"})
)
RETURN [n IN nodes(p) | n.name] AS path, length(p) AS hops

MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:BELONGS_TO]->(p:PREFIX)<-[:ROUTES]-(a:ASN {name: "AS15169"})
RETURN h.name, ip.name, p.name, a.name

-- collect() example
MATCH (h:HOSTNAME {name: "google.com"})<-[:NAMESERVER_FOR]-(ns:HOSTNAME)
RETURN collect(ns.name) AS nameservers, count(ns) AS cnt

-- Distance between San Francisco and New York
RETURN distance(
  point({latitude: 37.7749, longitude: -122.4194}),
  point({latitude: 40.7128, longitude: -74.0060})
) AS meters

-- Outbound: hostname resolves to IP
MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
RETURN ip.name

-- Inbound: reverse DNS — find hostnames resolving to a specific IP
MATCH (ip:IPV4 {name: "142.250.64.100"})<-[:RESOLVES_TO]-(h:HOSTNAME)
RETURN h.name LIMIT 10

-- Count: how many domains share this IP?
MATCH (ip:IPV4 {name: "104.16.123.96"})<-[:RESOLVES_TO]-(h:HOSTNAME)
RETURN count(h) AS cohosted

-- Find any neighbor regardless of edge direction
MATCH (h:HOSTNAME {name: "www.google.com"})--(neighbor)
RETURN labels(neighbor) AS lbl, neighbor.name LIMIT 5

-- Match both nameservers and mail servers
MATCH (h:HOSTNAME {name: "google.com"})<-[:NAMESERVER_FOR|MAIL_FOR]-(s:HOSTNAME)
RETURN s.name LIMIT 10

-- Network path: walk from IP through prefix to ASN (1 to 3 hops)
MATCH p = (ip:IPV4 {name: "142.250.64.100"})-[:BELONGS_TO|ROUTES*1..3]->(target)
RETURN [n IN nodes(p) | n.name] AS path, length(p) AS hops

MATCH p = (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)-[:BELONGS_TO]->(pfx:PREFIX)
RETURN [n IN nodes(p) | n.name] AS path, length(p) AS hops

MATCH (:HOSTNAME {name: "google.com"})<-[:MAIL_FOR]-(mx:HOSTNAME)
RETURN mx.name

-- Step 1: Identify the network owner
MATCH (ip:IPV4 {name: "142.250.64.100"})-[:BELONGS_TO]->(p:PREFIX)
      <-[:ROUTES]-(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN ip.name, p.name AS prefix, a.name AS asn, n.name AS asnName

-- Step 2: GeoIP lookup
MATCH (ip:IPV4 {name: "142.250.64.100"})-[:LOCATED_IN]->(city:CITY)
      -[:HAS_COUNTRY]->(country:COUNTRY)
RETURN ip.name, city.name AS city, country.name AS country

-- Step 3: How many domains resolve to this IP?
MATCH (ip:IPV4 {name: "104.16.123.96"})<-[:RESOLVES_TO]-(h:HOSTNAME)
RETURN count(h) AS cohostedDomains

-- Step 4: Sample co-hosted domains
MATCH (ip:IPV4 {name: "104.16.123.96"})<-[:RESOLVES_TO]-(h:HOSTNAME)
RETURN h.name LIMIT 10

-- Step 5: Find subdomains via suffix scan
MATCH (h:HOSTNAME) WHERE h.name ENDS WITH ".google.com"
RETURN h.name LIMIT 10

-- Step 6: Check ASN country registration
MATCH (a:ASN {name: "AS15169"})-[:HAS_COUNTRY]->(c:COUNTRY)
RETURN a.name, c.name AS country

-- IP to city
MATCH (ip:IPV4 {name: "1.1.1.1"})-[:LOCATED_IN]->(city:CITY)
RETURN ip.name, city.name

-- IP to city to country
MATCH (ip:IPV4 {name: "142.250.64.100"})-[:LOCATED_IN]->(city:CITY)
      -[:HAS_COUNTRY]->(country:COUNTRY)
RETURN ip.name, city.name, country.name

-- Distance calculation
RETURN distance(
  point({latitude: 37.7749, longitude: -122.4194}),
  point({latitude: 40.7128, longitude: -74.0060})
) AS meters

MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:LOCATED_IN]->(city:CITY)
RETURN h.name, ip.name, city.name

-- Count all routed prefixes
MATCH (a:ASN {name: "AS13335"})-[:ROUTES]->(p:PREFIX)
RETURN count(p) AS prefixCount

-- ASN name lookup
MATCH (a:ASN {name: "AS13335"})-[:HAS_NAME]->(n:ASN_NAME)
RETURN n.name

-- Find hostnames hosted on an ASN's infrastructure
MATCH (a:ASN {name: "AS13335"})-[:ROUTES]->(p:PREFIX)
      <-[:BELONGS_TO]-(ip:IPV4)<-[:RESOLVES_TO]-(h:HOSTNAME)
RETURN h.name LIMIT 10

-- ASN organizational registration
MATCH (a:ASN {name: "AS13335"})-[:REGISTERED_BY]->(org:ORGANIZATION)
RETURN org.name

-- Count BGP peers
MATCH (a:ASN {name: "AS13335"})-[:PEERS_WITH]->(peer:ASN)
RETURN count(peer) AS peerCount

-- Sample affected peers
MATCH (a:ASN {name: "AS13335"})-[:PEERS_WITH]->(peer:ASN)
RETURN peer.name LIMIT 5

-- Step 1: Find brand-impersonation domains (e.g. "paypal" outside paypal.com)
MATCH (h:HOSTNAME)
WHERE h.name CONTAINS "paypal"
  AND NOT h.name ENDS WITH ".paypal.com"
RETURN h.name LIMIT 15

-- Step 2: Pick a suspect domain and resolve it
MATCH (h:HOSTNAME {name: "paypal-accountlimited-resolutioncenter.netflixdxb.com"})
      -[:RESOLVES_TO]->(ip:IPV4)
RETURN h.name, ip.name

-- Step 3: What else is hosted on the same IPs?
MATCH (h:HOSTNAME {name: "paypal-accountlimited-resolutioncenter.netflixdxb.com"})
      -[:RESOLVES_TO]->(ip:IPV4)<-[:RESOLVES_TO]-(other:HOSTNAME)
WHERE other.name <> h.name
RETURN DISTINCT other.name LIMIT 15

-- Step 4: Map all subdomains under the parent domain
MATCH (h:HOSTNAME) WHERE h.name ENDS WITH ".netflixdxb.com"
RETURN h.name LIMIT 20

-- Step 5: Count subdomains -- a large number suggests a phishing kit
MATCH (h:HOSTNAME) WHERE h.name ENDS WITH ".netflixdxb.com"
RETURN count(h) AS subdomainCount

-- Step 6: Check nameservers -- parking services are a red flag
MATCH (h:HOSTNAME {name: "netflixdxb.com"})<-[:NAMESERVER_FOR]-(ns:HOSTNAME)
RETURN ns.name

-- Step 7: Pivot on nameserver -- what other domains use the same NS?
MATCH (ns:HOSTNAME {name: "ns1.parklogic.com"})-[:NAMESERVER_FOR]->(other:HOSTNAME)
RETURN other.name LIMIT 10

-- Step 8: Check mail infrastructure
MATCH (h:HOSTNAME {name: "netflixdxb.com"})<-[:MAIL_FOR]-(mx:HOSTNAME)
RETURN mx.name

-- Step 9: Network owner of the hosting IP
MATCH (ip:IPV4 {name: "172.233.219.123"})-[:BELONGS_TO]->(p:PREFIX)
      <-[:ROUTES]-(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN p.name AS prefix, a.name AS asn, n.name AS org

-- Step 10: Threat assessment
CALL explain("paypal-accountlimited-resolutioncenter.netflixdxb.com")

-- Step 1: Instant enrichment -- is it flagged, and where is it?
MATCH (ip:IPV4 {name: "185.220.101.1"})
OPTIONAL MATCH (ip)-[:LISTED_IN]->(f:FEED_SOURCE)
OPTIONAL MATCH (ip)-[:LOCATED_IN]->(city:CITY)-[:HAS_COUNTRY]->(country:COUNTRY)
RETURN ip.name, ip.threatScore, ip.threatLevel,
       collect(DISTINCT f.name) AS feeds,
       city.name AS city, country.name AS country

-- Step 2: Who owns the network?
MATCH (ip:IPV4 {name: "185.220.101.1"})-[:BELONGS_TO]->(p:PREFIX)
      <-[:ROUTES]-(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN p.name AS prefix, a.name AS asn, n.name AS asnName

-- Step 3: Reverse DNS -- what hostnames point here?
MATCH (h:HOSTNAME)-[:RESOLVES_TO]->(ip:IPV4 {name: "185.220.101.1"})
RETURN h.name LIMIT 10

-- Step 4: Neighborhood -- other flagged IPs in the same prefix
MATCH (ip:IPV4 {name: "185.220.101.1"})-[:BELONGS_TO]->(p:PREFIX)
      <-[:BELONGS_TO]-(neighbor:IPV4)
WHERE neighbor.threatLevel IS NOT NULL
RETURN neighbor.name, neighbor.threatScore, neighbor.threatLevel
ORDER BY neighbor.threatScore DESC LIMIT 5

-- Step 5: Detailed threat assessment
CALL explain("185.220.101.1")

-- Step 6: ASN-level threat posture -- is the whole network dirty?
MATCH (a:ASN {name: "AS60729"})
RETURN a.name, a.maxThreatScore, a.avgThreatScore, a.overallThreatLevel

-- Step 1: Batch threat check -- triage a list of IPs in one query
UNWIND ["93.174.95.106", "89.248.167.131", "185.220.101.1", "142.250.64.100"] AS addr
MATCH (ip:IPV4 {name: addr})
OPTIONAL MATCH (ip)-[:LISTED_IN]->(f:FEED_SOURCE)
RETURN ip.name, ip.threatScore, ip.threatLevel, collect(f.name) AS feeds
ORDER BY ip.threatScore DESC

-- Step 2: Filter to scam-relevant feeds only
-- Phishing, spam, blacklists, and proxy feeds catch most scam infrastructure
MATCH (ip:IPV4 {name: "93.174.95.106"})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name IN [
  "OpenPhish Feed", "Blocklist.de Mail", "Blocklist.de All",
  "Spamhaus DROP", "Spamhaus EDROP", "FireHOL Level 1",
  "FireHOL Level 2", "GreenSnow Blacklist", "CINS Score"
]
RETURN f.name

-- Step 3: Infrastructure context -- who, where, what hostname
MATCH (ip:IPV4 {name: "93.174.95.106"})
OPTIONAL MATCH (ip)-[:BELONGS_TO]->(p:PREFIX)<-[:ROUTES]-(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
OPTIONAL MATCH (ip)-[:LOCATED_IN]->(city:CITY)-[:HAS_COUNTRY]->(country:COUNTRY)
OPTIONAL MATCH (h:HOSTNAME)-[:RESOLVES_TO]->(ip)
RETURN ip.name, ip.threatScore, ip.threatLevel,
       p.name AS prefix, a.name AS asn, n.name AS org,
       city.name AS city, country.name AS country,
       collect(DISTINCT h.name) AS hostnames

-- Step 4: Neighborhood check -- are other IPs in the same /24 also flagged?
MATCH (ip:IPV4 {name: "93.174.95.106"})-[:BELONGS_TO]->(p:PREFIX)
      <-[:BELONGS_TO]-(neighbor:IPV4)
WHERE neighbor.threatLevel IS NOT NULL
RETURN neighbor.name, neighbor.threatScore, neighbor.threatLevel
ORDER BY neighbor.threatScore DESC LIMIT 10

-- Step 5: Full assessment for a report
CALL explain("93.174.95.106")

-- Step 6: Batch triage with full context (combine steps 1 + 3)
UNWIND ["93.174.95.106", "89.248.167.131", "185.220.101.1"] AS addr
MATCH (ip:IPV4 {name: addr})
OPTIONAL MATCH (ip)-[:LISTED_IN]->(f:FEED_SOURCE)
OPTIONAL MATCH (ip)-[:BELONGS_TO]->(p:PREFIX)<-[:ROUTES]-(a:ASN)
OPTIONAL MATCH (ip)-[:LOCATED_IN]->(city:CITY)-[:HAS_COUNTRY]->(co:COUNTRY)
RETURN ip.name, ip.threatScore, ip.threatLevel,
       collect(DISTINCT f.name) AS feeds,
       p.name AS prefix, a.name AS asn,
       city.name AS city, co.name AS country
ORDER BY ip.threatScore DESC

-- Nameserver inventory
MATCH (h:HOSTNAME {name: "google.com"})<-[:NAMESERVER_FOR]-(ns:HOSTNAME)
RETURN ns.name

-- Mail servers
MATCH (h:HOSTNAME {name: "google.com"})<-[:MAIL_FOR]-(mx:HOSTNAME)
RETURN mx.name

-- SPF record analysis
MATCH (h:HOSTNAME {name: "cloudflare.com"})-[:SPF_INCLUDE]->(target:HOSTNAME)
RETURN target.name

-- List all DNSSEC algorithms in the graph
MATCH (a:DNSSEC_ALGORITHM)
RETURN a.name

-- Find registrar for a domain
MATCH (h:HOSTNAME {name: "google.com"})-[:HAS_REGISTRAR]->(r:REGISTRAR)
RETURN r.name AS current_registrar

-- Check historical registrars (registrar changes over time)
MATCH (h:HOSTNAME {name: "google.com"})-[:PREV_REGISTRAR]->(r:REGISTRAR)
RETURN r.name AS previous_registrar

-- Find contact emails for a domain
MATCH (h:HOSTNAME {name: "google.com"})-[:HAS_EMAIL]->(e:EMAIL)
RETURN e.name

-- Find contact phone for a domain
MATCH (h:HOSTNAME {name: "google.com"})-[:HAS_PHONE]->(p:PHONE)
RETURN p.name

-- Find registrant organization
MATCH (h:HOSTNAME {name: "cloudflare.com"})-[:REGISTERED_BY]->(o:ORGANIZATION)
RETURN o.name

-- List TLD operators
MATCH (op:TLD_OPERATOR)
RETURN op.name LIMIT 5

-- Cross-reference: find all domains sharing the same registrar
MATCH (h:HOSTNAME {name: "example.com"})-[:HAS_REGISTRAR]->(r:REGISTRAR)
      <-[:HAS_REGISTRAR]-(other:HOSTNAME)
WHERE other.name <> "example.com"
RETURN other.name LIMIT 10

-- Prefix count by Regional Internet Registry
MATCH (r:RIR)<-[:BELONGS_TO]-(p:PREFIX)
RETURN r.name, count(p) AS prefix_count ORDER BY prefix_count DESC

-- ASN profile: name and country
MATCH (a:ASN {name: "AS15169"})-[:HAS_NAME]->(n:ASN_NAME)
MATCH (a)-[:HAS_COUNTRY]->(c:COUNTRY)
RETURN a.name, n.name AS asnName, c.name AS country

-- Top countries by ASN count
MATCH (c:COUNTRY)<-[:HAS_COUNTRY]-(a:ASN)-[:ROUTES]->(p:PREFIX)
WITH c.name AS country, count(DISTINCT a) AS asn_count
RETURN country, asn_count ORDER BY asn_count DESC LIMIT 5

-- Find outbound web links
MATCH (h:HOSTNAME {name: "google.com"})-[:LINKS_TO]->(target:HOSTNAME)
RETURN target.name LIMIT 10

MATCH (h:HOSTNAME {name: "www.example.com"})-[:ALIAS_OF]->(target:HOSTNAME)
RETURN h.name, target.name

MATCH (h:HOSTNAME {name: "www.google.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:BELONGS_TO]->(p:PREFIX)<-[:ROUTES]-(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN h.name, ip.name, p.name, a.name, n.name

-- Find subdomains with a prefix
MATCH (h:HOSTNAME) WHERE h.name STARTS WITH "mail.google"
RETURN h.name LIMIT 10

-- Classify hostnames by type
MATCH (h:HOSTNAME {name: "www.google.com"})
RETURN h.name,
  CASE
    WHEN h.name STARTS WITH "www." THEN "web"
    WHEN h.name STARTS WITH "mail." THEN "mail"
    WHEN h.name STARTS WITH "ns" THEN "nameserver"
    ELSE "other"
  END AS hostType

-- Batch hostname resolution with IP addresses
UNWIND ['www.google.com', 'cloudflare.com'] AS h
MATCH (n:HOSTNAME {name: h})-[:RESOLVES_TO]->(ip:IPV4)
RETURN n.name, ip.name

-- Batch hostname lookup with per-host IP count
UNWIND ['www.google.com', 'cloudflare.com'] AS h
CALL { WITH h MATCH (n:HOSTNAME {name: h})-[:RESOLVES_TO]->(ip:IPV4) RETURN count(ip) AS cnt }
RETURN h, cnt

-- Parameterized ASN lookup with context
WITH 'AS13335' AS asnName
MATCH (a:ASN {name: asnName})-[:HAS_NAME]->(n:ASN_NAME)
RETURN a.name, n.name

-- Check if an IP is listed in any threat feed
MATCH (ip:IPV4 {name: "185.220.101.1"})-[:LISTED_IN]->(f:FEED_SOURCE)
RETURN f.name, ip.threatScore, ip.threatLevel

-- Check threat category booleans for an IP
MATCH (ip:IPV4 {name: "185.220.101.1"})
RETURN ip.isThreat, ip.isTor, ip.isC2, ip.isMalware, ip.isAnonymizer, ip.threatSources

-- ASN enrichment: check threat posture
MATCH (a:ASN {name: "AS13335"})
RETURN a.maxThreatScore, a.avgThreatScore, a.overallThreatLevel, a.hasThreateningPrefixes

-- PREFIX BGP enrichment: check routing status
MATCH (p:PREFIX {name: "104.16.112.0/20"})
RETURN p.isMoas, p.isAnycast, p.isWithdrawn

-- ASN BGP peers
MATCH (a:ASN {name: "AS13335"})-[:PEERS_WITH]->(n:ASN)
RETURN n.name LIMIT 5

-- Explain an IP address (Tor exit node)
CALL explain("185.220.101.1")

{
  "indicator": "185.220.101.1",
  "type": "ip",
  "found": true,
  "score": 14.48,
  "level": "INFO",
  "explanation": "185.220.101.1 is listed in 5 threat feed(s). Score 14.5 (Informational - minimal risk).",
  "factors": [
    "Listed in 5 source(s) with combined weight 4.50",
    "Base score: 4.50 x log2(5 + 1) = 11.63",
    "Recency boost: x1.2 (last seen just now)",
    "Age boost: x1.04 (on lists for 2 days)",
    "Final score: 11.63 x 1.2 x 1.04 = 14.48"
  ],
  "sources": [
    {"feedId": "dan-tor-exit", "weight": 0.5},
    {"feedId": "firehol-level2", "weight": 1.3},
    {"feedId": "stamparm-ipsum", "weight": 1.2},
    {"feedId": "tor-exit-nodes", "weight": 0.5},
    {"feedId": "greensnow", "weight": 1.0}
  ]
}

-- Explain an ASN (returns reputation score)
CALL explain("AS13335")

{
  "indicator": "AS13335",
  "type": "asn",
  "found": true,
  "score": 0.0,
  "level": "NONE",
  "explanation": "AS13335 (CLOUDFLARENET - Cloudflare, Inc., US) has a reputation score of 75.0 (REPUTABLE).",
  "factors": [
    "Threat density score: 50.0/100 (weight: 35%)",
    "Graph metrics score: 90.0/100 (weight: 25%)",
    "Historical behavior score: 75.0/100 (weight: 25%)",
    "Prefix age score: 20.0/100 (weight: 15%)",
    "Composite: (50.0x0.35) + (90.0x0.25) + (75.0x0.25) + (20.0x0.15) = 61.8"
  ],
  "breakdown": {
    "threatDensityScore": 50.0,
    "graphMetricsScore": 90.0,
    "historicalScore": 75.0,
    "prefixAgeScore": 20.0
  }
}

-- Explain a CIDR prefix (returns threat density)
CALL explain("1.1.1.0/24")

{
  "indicator": "1.1.1.0/24",
  "type": "network",
  "found": true,
  "score": 0.0,
  "level": "INFO",
  "explanation": "Network 1.1.1.0/24 contains 1 listed IP(s) and 0 listed subnet(s). Threat density: 0.3906%.",
  "factors": [
    "Listed IPs: 1 IPs found -> 10 x log2(1 + 1) = 10.00",
    "Threat density: 1 listed / 256 addresses = 0.3906%",
    "Final aggregate score: 10.00"
  ]
}

-- Explain a domain
CALL explain("example.com")

Base score = combined_weight x log2(num_sources + 1)
Recency boost = 1.2 if last seen < 24h, 1.0 if < 7d, 0.8 if < 30d, 0.5 otherwise
Final score = base_score x recency_boost

CALL whisper.history("indicator")

CALL whisper.history("google.com")

{
  "columns": ["indicator", "type", "queryTime", "createDate", "updateDate",
              "expiryDate", "registrar", "registrant", "country", "nameServers", "cached"],
  "rows": [
    {
      "indicator": "google.com",
      "type": "domain",
      "queryTime": "2024-11-05 21:15:21",
      "createDate": "1997-09-05",
      "updateDate": "2024-08-02",
      "expiryDate": "2028-09-13",
      "registrar": "MarkMonitor, Inc.",
      "registrant": "Google LLC",
      "country": "US",
      "nameServers": "ns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com",
      "cached": false
    }
  ]
}

CALL whisper.history("8.8.8.8")

{
  "columns": ["indicator", "type", "origin", "prefix", "startTime",
              "endTime", "visibility", "peersSeing", "cached"],
  "rows": [
    {
      "indicator": "8.8.8.8",
      "type": "routing",
      "origin": "AS3356",
      "prefix": "8.0.0.0/8",
      "startTime": "2003-06-01T00:00:00",
      "endTime": "2003-06-12T23:59:59",
      "visibility": 0.0,
      "peersSeing": 41,
      "cached": false
    }
  ]
}

-- Network prefix history
CALL whisper.history("8.8.8.0/24")

-- IPv6 routing history
CALL whisper.history("2001:4860:4860::8888")

{
  "columns": ["indicator", "type", "available", "error", "retryAfter"],
  "rows": [{"indicator": "AS15169", "type": "asn", "available": false, "error": "timeout", "retryAfter": 30}]
}

CALL db.labels()

CALL db.relationshipTypes()

CALL db.propertyKeys()

CALL db.schema.nodeTypeProperties()

CALL db.schema.relTypeProperties()

CALL db.schema()             -- Default: human-readable Cypher-style schema
CALL db.schema("json")       -- Machine-readable JSON (includes nodes, relationships, stats, procedures)
CALL db.schema("markdown")   -- Markdown documentation with tables
CALL db.schema("details")    -- Verbose with descriptions, examples, and property lists

CALL db.schema.visualization()

CALL explain("185.220.101.1")  -- IP threat assessment
CALL explain("example.com")     -- Domain threat assessment
CALL explain("AS13335")         -- ASN reputation score
CALL explain("1.1.1.0/24")     -- CIDR threat density

CALL whisper.history("google.com")          -- Domain WHOIS history
CALL whisper.history("8.8.8.8")             -- BGP routing history
CALL whisper.history("8.8.8.0/24")          -- Network prefix history
CALL whisper.history("2001:4860:4860::8888") -- IPv6 routing history
CALL whisper.history("AS15169")             -- ASN routing history