whisper.history() — Point-in-Time
WHOIS registration and BGP routing history for any indicator, as timestamped snapshots you can diff.
whisper.history() — Point-in-Time Documentation
The graph's nodes and edges describe the internet as it is now. whisper.history() adds the time axis: pass it an indicator and it returns timestamped historical snapshots, so you can see what a registration or a route looked like at earlier points in time and what changed between snapshots.
The procedure serves two kinds of history depending on the indicator. For a domain it returns WHOIS registration snapshots. For an IP, ASN, or CIDR prefix it returns BGP routing history: which network announced a block, and when. It needs an API key; the anonymous tier has no access to it (see Access below).
WHOIS history for a domain
For a domain, each snapshot carries the creation and update dates, the registrar, the registrant, and the nameservers at that point in time.
CALL whisper.history("google.com")
YIELD createDate, updateDate, registrar, registrant, nameServers
RETURN createDate, updateDate, registrar, registrant, nameServers
LIMIT 3
[
{"createDate": "1997-09-05", "updateDate": "2024-08-02", "registrar": "MarkMonitor, Inc.", "registrant": "Google LLC", "nameServers": "ns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com"},
{"createDate": "1997-09-15", "updateDate": "2015-06-12", "registrar": "MarkMonitor, Inc.", "registrant": "Google Inc.", "nameServers": "ns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com"}
]
Read the snapshots as a timeline. A registrant that changes across snapshots, or a creation date far more recent than the brand the domain imitates, is a classic abuse tell. When you are clustering an actor's infrastructure, the registration timeline is how you confirm a candidate domain matches the actor's tempo.
Piercing WHOIS redaction
Privacy services redact a large share of current WHOIS, so treat a missing registrant as withheld, then check the history. whisper.history.whois returns the time series of WHOIS records, and an older snapshot often shows an un-redacted registrant even when the current record reads "DATA REDACTED":
CALL whisper.history.whois("cloudflare.com")
YIELD registrar, registrant, country, createDate
RETURN registrar, registrant, country, createDate
LIMIT 4
[
{"registrar": "CloudFlare, Inc.", "registrant": "CloudFlare, Inc.", "country": "US", "createDate": "2009-02-17"},
{"registrar": "Cloudflare, Inc.", "registrant": "DATA REDACTED", "country": "US", "createDate": "2009-02-17"}
]
BGP routing history
Pass an ASN, an IP, or a prefix and the same procedure returns routing history instead: the origin network, the prefix, and its visibility at each snapshot.
CALL whisper.history("AS13335")
YIELD origin, prefix, visibility
RETURN origin, prefix, visibility
LIMIT 3
BGP history over a large network can take many seconds. Keep a LIMIT on it and expect a longer round trip than an anchored read.
Diff and time-machine patterns
The most useful shape is a diff: fetch the history, compare the two most recent snapshots, and the fields that differ are your findings. A registrar change, a new nameserver set, or a prefix that moved to a different origin ASN each points at a concrete event worth investigating. Run anything that changed through explain() to score its current state; history tells you what moved, the verdict tells you whether it matters now.
The Time Machine workflow runs exactly this pattern in the browser: it calls whisper.history() on your indicator and surfaces the state diff between its two most recent WHOIS/BGP records. For replaying how a whole region or org was wired at a point in time, see Research & OSINT.
Access
whisper.history() requires an authenticated key; it is one of the advanced procedures that anonymous requests cannot call. A free key is enough: create an account and pass the key in the X-API-Key header. You can check your tier and remaining quota at any time with CALL whisper.quota(), which does not count against quota. Auth details, headers, and tier limits are on the Cypher API page.
On the MCP surface the same capability is the whisper_history tool; see the MCP reference. For the other procedures, go back to the procedures overview.