Historical State & Change Tracking
Change is a signal. This tracks how an indicator's ownership and routing shifted across snapshots — registrar changes, routing hand-offs, and the timeline behind them — surfacing the kind of movement that flags a hijack, a transfer, or a quiet change of control.
How it uses the graph
Traverses the historical, WHOIS, BGP layers of the graph, in 4 steps:
How it walks the graph4 steps
01Fetch history
Pulling the indicator's WHOIS/BGP history…
historicalWHOISBGP
02WHOIS Record Timeline
WHOIS Record Timeline…
historicalWHOISBGP
03Registrar Change (Transfer/Hijack Signal)
Registrar Change (Transfer/Hijack Signal)…
historicalWHOISBGP
04BGP Routing Timeline
BGP Routing Timeline…
historicalWHOISBGP
Why each step runs
- 01Fetch history. Retrieves the historical snapshots whose two most recent records form the state diff this workflow exists to surface.
- 02WHOIS Record Timeline. Lays out the domain's WHOIS record over time so you can spot when the registrar, registrant, expiry date, or nameservers changed.
- 03Registrar Change (Transfer/Hijack Signal). Flags when a domain's registrar-of-record differs from its previous one, a possible transfer or hijack signal.
- 04BGP Routing Timeline. Shows the origin-ASN and prefix announcements for a prefix or IP over time so you can catch routing-origin shifts and possible hijacks.