whisper.history() — Point-in-Time

The graph's nodes and edges describe the internet as it is now. whisper.history() adds the time axis: pass it an indicator and it returns timestamped historical snapshots, so you can see what a registration or a route looked like at earlier points in time and what changed between snapshots.

The procedure serves two kinds of history depending on the indicator. For a domain it returns WHOIS registration snapshots. For an IP, ASN, or CIDR prefix it returns BGP routing history: which network announced a block, and when.

Because whisper.history() picks the shape from the indicator, its columns change at runtime. Name columns from one shape only, or call the single-shape variants, whisper.history.whois and whisper.history.bgp, whose columns never move. From automation, always call the variant.

WHOIS history for a domain

For a domain, each snapshot carries the creation and update dates, the registrar, the registrant, and the nameservers at that point in time.

CALL whisper.history("google.com")
YIELD createDate, updateDate, registrar, registrant, nameServers
RETURN createDate, updateDate, registrar, registrant, nameServers
LIMIT 3

[
  {"createDate": "1997-09-05", "updateDate": "2024-08-02", "registrar": "MarkMonitor, Inc.", "registrant": "Google LLC", "nameServers": "ns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com"},
  {"createDate": "1997-09-15", "updateDate": "2015-06-12", "registrar": "MarkMonitor, Inc.", "registrant": "Google Inc.", "nameServers": "ns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com"}
]

Read the snapshots as a timeline. A registrant that changes across snapshots, or a creation date far more recent than the brand the domain imitates, is a classic abuse tell. When you are clustering an actor's infrastructure, the registration timeline is how you confirm a candidate domain matches the actor's tempo.

The WHOIS shape is indicator, type, queryTime, createDate, updateDate, expiryDate, registrar, registrant, country, nameServers, cached, registrableDomain. Registration data lives on the registrable domain, so whisper.history.whois folds a subdomain up to its registrable parent, and folds a URL down to its host first. indicator echoes what you asked for, registrableDomain names the parent the lookup resolved to, and the response carries a whois-parent-fold advisory naming the swap. An apex folds to itself, with no advisory. Zero rows means the registrable parent has no registration record on file, not that the fold failed.

CALL whisper.history.whois("www.cloudflare.com")
YIELD indicator, registrableDomain, registrar, registrant, createDate
RETURN indicator, registrableDomain, registrar, registrant, createDate
LIMIT 2

Piercing WHOIS redaction

Privacy services redact a large share of current WHOIS, so treat a missing registrant as withheld, then check the history. whisper.history.whois returns the time series of WHOIS records, and an older snapshot often shows an un-redacted registrant even when the current record reads "DATA REDACTED":

CALL whisper.history.whois("cloudflare.com")
  YIELD registrar, registrant, country, createDate
RETURN registrar, registrant, country, createDate
LIMIT 4

[
  {"registrar": "CloudFlare, Inc.", "registrant": "CloudFlare, Inc.", "country": "US", "createDate": "2009-02-17"},
  {"registrar": "Cloudflare, Inc.", "registrant": "DATA REDACTED", "country": "US", "createDate": "2009-02-17"}
]

BGP routing history

Pass an ASN, an IP, or a prefix and the same procedure returns routing history instead. The explicit form is whisper.history.bgp; each snapshot yields the origin ASN, the prefix, the window it was seen in, and how visible the announcement was. The routing shape is indicator, type, origin, prefix, startTime, endTime, visibility, peersSeing, cached; note the spelling of peersSeing.

CALL whisper.history.bgp("8.8.8.8")
YIELD indicator, type, origin, prefix, startTime, endTime, visibility, peersSeing
RETURN origin, prefix, startTime, endTime, visibility, peersSeing
LIMIT 3

BGP history over a large network can take many seconds. Keep a LIMIT on it and expect a longer round trip than an anchored read; if a cold read comes back empty, run it again.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. Full contract: Coverage — what we looked at.

Diff and time-machine patterns

The most useful shape is a diff: fetch the history, compare the two most recent snapshots, and the fields that differ are your findings. A registrar change, a new nameserver set, or a prefix that moved to a different origin ASN each points at a concrete event worth investigating. Run anything that changed through explain() to score its current state; history tells you what moved, the verdict tells you whether it matters now.

There is no guided browser workflow for this specific diff pattern today — run the Cypher above directly against the HTTP API. For replaying how a whole region or org was wired at a point in time, see the Internet Research recipes.

Access

Pass your API key in the X-API-Key header — sign in to get one. Auth details and headers are on the HTTP API page.

One shape per call: the WHOIS columns (registrar, registrant, nameServers, createDate …) and the routing columns (origin, prefix, visibility …) can never appear in the same row, and a YIELD that mixes them is rejected with a message naming the single-shape call for each column; the error's suggestions[] carries a multi_shape_yield entry a client can branch on. Call whisper.history.whois(domain) or whisper.history.bgp(indicator) when you want one of them by itself.

On the MCP surface, run the same calls through the query tool; see the MCP reference. For the other procedures, go back to the procedures overview.