Graph Schema Reference
Node labels, edge types, multi-hop patterns, and the ER diagram for WhisperGraph. Used by every Cypher query.
Updated May 2026
Graph Schema Reference Documentation
Reference for the WhisperGraph schema: every node label, every edge type, and the multi-hop patterns that connect them. Use this alongside the Cypher syntax reference when writing queries.
Schema guide
Node labels
| Label | Description | Example values |
|---|---|---|
| HOSTNAME | Fully-qualified domain names, subdomains, mail server names | www.google.com, ns1.cloudflare.com |
| IPV4 | IPv4 addresses | 1.1.1.1, 142.250.64.100 |
| IPV6 | IPv6 addresses | 2606:4700::6810:84e5 |
| PREFIX | IP CIDR blocks | 142.250.64.0/24 |
| REGISTERED_PREFIX | RIR-allocated IP blocks (virtual, resolved at query time) | 1.1.1.0/24 |
| ANNOUNCED_PREFIX | BGP-announced prefixes (virtual, resolved at query time) | 104.16.128.0/20 |
| ASN | Autonomous system numbers | AS13335, AS15169 |
| ASN_NAME | Human-readable AS organization names | CLOUDFLARENET - Cloudflare, Inc. |
| TLD | Top-level domains | com, net, org, io |
| TLD_OPERATOR | TLD registry operators | VeriSign, Inc. |
| REGISTRAR | Domain registrars (IANA ID format) | iana:292 (MarkMonitor) |
| WHOIS contact email addresses | domains@cloudflare.com | |
| PHONE | WHOIS contact phone numbers (E.164) | +14158675825 |
| ORGANIZATION | Organizations from WHOIS records | cloudflare hostmaster |
| CITY | GeoIP city with country code | Mountain View, US |
| COUNTRY | ISO 3166-1 alpha-2 country codes | US, DE, AU |
| RIR | Regional Internet Registries | ARIN, RIPENCC, APNIC, LACNIC, AFRINIC |
| DNSSEC_ALGORITHM | DNSSEC signing algorithms | ECDSAP256SHA256, RSASHA256 |
| FEED_SOURCE | Threat intelligence feed sources (virtual) | Spamhaus DROP, Feodo Tracker |
| CATEGORY | Threat feed categories (virtual) | C2 Servers, Phishing |
Edge types
DNS resolution
| Edge type | From | To | Description |
|---|---|---|---|
| RESOLVES_TO | HOSTNAME | IPV4/IPV6 | DNS A/AAAA records |
| CHILD_OF | HOSTNAME | HOSTNAME/TLD | Domain hierarchy (sub.example.com -> example.com -> com) |
| ALIAS_OF | HOSTNAME | HOSTNAME | CNAME records |
| NAMESERVER_FOR | HOSTNAME | HOSTNAME | NS delegation (nameserver serves the target domain) |
| MAIL_FOR | HOSTNAME | HOSTNAME | MX records (mail server handles mail for the target domain) |
| SIGNED_WITH | HOSTNAME | DNSSEC_ALGORITHM | DNSSEC signing algorithm |
BGP and routing
| Edge type | From | To | Description |
|---|---|---|---|
| ANNOUNCED_BY | IPV4/PREFIX | ANNOUNCED_PREFIX | BGP announcement (virtual, resolved at query time) |
| ROUTES | ASN | ANNOUNCED_PREFIX | ASN routes this prefix (virtual) |
| BELONGS_TO | IPV4 | PREFIX/REGISTERED_PREFIX/ANNOUNCED_PREFIX | IP membership in a prefix block |
| PEERS_WITH | ASN | ASN | BGP peering session (virtual) |
| HAS_NAME | ASN | ASN_NAME | Network operator name (virtual) |
| HAS_COUNTRY | ASN/PREFIX | COUNTRY | Country assignment |
WHOIS and registration
| Edge type | From | To | Description |
|---|---|---|---|
| HAS_REGISTRAR | HOSTNAME | REGISTRAR | Current domain registrar |
| PREV_REGISTRAR | HOSTNAME | REGISTRAR | Previous domain registrar |
| REGISTERED_BY | HOSTNAME/REGISTERED_PREFIX | ORGANIZATION | WHOIS registrant organization |
| HAS_EMAIL | HOSTNAME | WHOIS contact email | |
| HAS_PHONE | HOSTNAME | PHONE | WHOIS contact phone |
GeoIP
| Edge type | From | To | Description |
|---|---|---|---|
| LOCATED_IN | IPV4 | CITY | GeoIP city location |
| LOCATED_IN | CITY | COUNTRY | City to country mapping |
Threat intelligence
| Edge type | From | To | Description |
|---|---|---|---|
| LISTED_IN | IPV4/HOSTNAME | FEED_SOURCE | IP or hostname appears in this threat feed (virtual) |
| BELONGS_TO | FEED_SOURCE | CATEGORY | Feed classified under this category |
Web
| Edge type | From | To | Description |
|---|---|---|---|
| LINKS_TO | HOSTNAME | HOSTNAME | Hyperlink between hostnames (from web crawl data) |
SPF
| Edge type | From | To | Description |
|---|---|---|---|
| SPF_INCLUDE | HOSTNAME | HOSTNAME | SPF include: mechanism |
| SPF_IP | HOSTNAME | PREFIX | SPF ip4: / ip6: mechanism |
| SPF_A | HOSTNAME | HOSTNAME | SPF a: mechanism |
| SPF_MX | HOSTNAME | HOSTNAME | SPF mx: mechanism |
| SPF_REDIRECT | HOSTNAME | HOSTNAME | SPF redirect= modifier |
| SPF_EXISTS | HOSTNAME | HOSTNAME | SPF exists: mechanism |
Other
| Edge type | From | To | Description |
|---|---|---|---|
| OPERATES | TLD_OPERATOR | TLD | Registry operator manages this TLD (virtual) |
Entity relationship diagram
Entity Relationship Diagram
Solid lines are physical edges stored on disk. Dashed lines are virtual edges computed at query time from live infrastructure and threat intelligence data.
Solid lines are physical edges stored on disk. Dashed lines are virtual edges computed at query time from live infrastructure and threat intelligence data.
Multi-hop path patterns
These are the most common traversal chains through the graph.
Domain to network owner:
HOSTNAME -[:RESOLVES_TO]-> IPV4 -[:ANNOUNCED_BY]-> ANNOUNCED_PREFIX -[:ROUTES]-> ASN -[:HAS_NAME]-> ASN_NAME
Domain to nameservers:
HOSTNAME(ns) -[:NAMESERVER_FOR]-> HOSTNAME(domain)
Domain to mail servers:
HOSTNAME(mx) -[:MAIL_FOR]-> HOSTNAME(domain)
IP to GeoIP location:
IPV4 -[:LOCATED_IN]-> CITY -[:LOCATED_IN]-> COUNTRY
IP to threat feeds:
IPV4 -[:LISTED_IN]-> FEED_SOURCE -[:BELONGS_TO]-> CATEGORY
Domain WHOIS chain:
HOSTNAME -[:HAS_REGISTRAR]-> REGISTRAR
HOSTNAME -[:HAS_EMAIL]-> EMAIL
HOSTNAME -[:REGISTERED_BY]-> ORGANIZATION
DNS hierarchy:
HOSTNAME -[:CHILD_OF]-> HOSTNAME(parent) -[:CHILD_OF]-> TLD
RIR allocation chain:
IPV4 -[:BELONGS_TO]-> REGISTERED_PREFIX -[:REGISTERED_BY]-> ORGANIZATION