Entities

Every entity in WhisperGraph is a node with a label and, for almost every label, a name. This page lists every node label the engine returns — what each represents, how many exist, whether it is joinable at all, and the properties you can filter and return. For the edges that join them, see Connection Types; for the chains that cross layers, see Pivoting Examples.

There is no Domain or FQDN label — every name is a HOSTNAME. There is no Certificate label either — certificate observations are CT_OBSERVATION. The table below is generated: its rows are whatever CALL db.labels() returned when the census last ran, and its counts resolve at render from that same census. A label the engine adds appears here without anyone typing it, and a label the engine drops leaves.

The Edge types column is the number of edge types that name the label as a source or a target in CALL db.relationshipTypes(). Read it as declared, not as reachable: CATEGORY shows zero and yet (f:FEED_SOURCE)-[:BELONGS_TO]->(c:CATEGORY) returns rows, because BELONGS_TO carries that hop without declaring it, and URL shows zero although (u:URL {name: "…"})-[:LINKS_TO]->(h:HOSTNAME) traverses. A zero is a reason to check. Three labels really are node-only — DNS_ROOT_INSTANCE, DWI_DOMAIN and RIR hold no edge of any type. They list; the traversal cannot be written.

Node labels

Core DNS & addressing

Routing & organization

WHOIS & registration

Geo & DNSSEC

Threat intelligence

RPKI & routing observations

Physical infrastructure

Egress, fingerprint & transparency

Web & technology

Rows measured live from CALL db.labels(), 2026-10-21. The counts render as tokens resolved from the same live figures, so a replica disagreeing by a few million moves the number without moving the table.

Most node labels carry an indexed name, and {name: "value"} lookups hit that index. ROA does not — identify a ROA by the prefix and ASN it authorizes. FEED_SOURCE, CATEGORY, ANNOUNCED_PREFIX, and REGISTERED_PREFIX are virtual labels synthesized at query time. The small ones (FEED_SOURCE, CATEGORY) can be listed directly; reach the prefix labels through an edge (ANNOUNCED_BY, BELONGS_TO) rather than scanning them.

ORGANIZATION names are raw registrant strings, so reach an organization through an edge and fold it. The same company appears under several strings — github hostmaster, github, and GitHub, Inc. are all ORGANIZATION nodes — and casing and punctuation follow whatever the WHOIS or RIR record carried. Anchor on a hostname, ASN or registered prefix, traverse REGISTERED_BY to its organization, then follow SAME_ORG_AS to the canonical company record and use that name for further pivots. A guessed display string may match a different variant, or none at all.

Three labels are node-only, and the difference matters before you write the query. DNS_ROOT_INSTANCE (root-server anycast instances, with a rootLetter), DWI_DOMAIN (dark-web domains under watch) and RIR hold no edge of any type. They can be counted and read property by property; the traversal into or out of them cannot be written. Read an ASN's registry off ASN.autNumSourceRir rather than joining RIR. RDAP_ENTITY is not in this group: REGISTERED_TO_ENTITY reaches it from a PREFIX or an ASN. Nor is BGP_PATH_OBSERVATION, which is reached over BGP_PATH.

Node properties

Most labels carry only name. Threat-listed indicators, announced prefixes, ASNs, and ROAs carry richer, queryable properties.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. Full contract: Coverage — what we looked at.

Threat & verdict (on threat-listed IPV4 / IPV6 / HOSTNAME)

Project the verdict properties by name (RETURN ip.verdictLevel, ip.verdictScore). A whole-node projection (RETURN ip) can leave them out, and the response says so in its advisories.

Boolean flags, derived from the categories of the feeds that list the node: isThreat, isAnonymizer, isC2, isMalware, isPhishing, isSpam, isBruteforce, isScanner, isBlacklist, isTor, isProxy, isVpn, isWhitelist, isReputation, isBotnet, isDga, isStateActor, isExfilDestination, isOfacSanctioned, isScam and isEgressRisk, plus egressClasses, a list naming the kind of egress (tor-exit). A node can carry a threat listing and a whitelist marker at the same time: read verdictLevel as the verdict and treat the whitelist marker as context, not as an override.

HOSTNAME nodes also carry rank, a popularity rank where lower means more prevalent (google.com ranks first). It is how you tell a listed name apart from a listed name that half the internet visits.

Curated well-known infrastructure (public resolvers like 8.8.8.8) carries allowlisted: true, and its verdict surfaces (verdictLevel, threatLevel, isThreat) are clamped to benign. The raw threatScore is not clamped, so it keeps the feed evidence.

// Triage an IP on the reconciled verdict (preferred over raw threatScore)
MATCH (ip:IPV4 {name: "185.220.101.1"})
RETURN ip.name, ip.verdictScore, ip.verdictLevel, ip.verdictBlocking, ip.isTor, ip.isAnonymizer
LIMIT 1

BGP enrichment (on ANNOUNCED_PREFIX)

Reputation, hijack posture and aggregate threat (on ASN)

RPKI (on ROA)

A ROA has no name. Its identity is the pair prefix + asn, and you reach it over ROA_AUTHORIZES_ORIGIN from an ASN or ROA_AUTHORIZES_PREFIX from a prefix rather than by lookup.

Other enriched labels

LISTED_IN edges carry no queryable properties. The per-feed evidence behind a verdict (each feed's weight and first/last-seen timestamps) comes from explain(), which returns it as an inspectable sources array.

Confirm a label before you anchor

CALL db.labels() YIELD label RETURN label ORDER BY label

db.labels() lists every node label with its count, and it answers immediately. Checking it first is the fastest cure for the most common mistake — anchoring on a label that doesn't exist and getting empty results with no error.

CALL db.propertyKeys() and CALL db.schema.nodeTypeProperties() show the live property set, but use them to discover, not to enumerate: nodeTypeProperties() lists a subset of what a node actually carries. When you need the full set for one node, return the node itself and read the keys off the response, or project the properties you need by name.