Entities

Core DNS & addressing

Routing & organization

WHOIS & registration

Geo & DNSSEC

Threat intelligence

RPKI & routing observations

Physical infrastructure

Egress, fingerprint & transparency

Rows generated from CALL db.labels() YIELD label, count against https://graph.whisper.security, fetched 2026-08-09T21:11:53Z. The counts render from that same census, so a replica disagreeing by a few million moves the number without moving the table.

Most node labels carry an indexed name, and {name: "value"} lookups hit that index. ROA does not — identify a ROA by the prefix and ASN it authorizes. FEED_SOURCE, CATEGORY, ANNOUNCED_PREFIX, and REGISTERED_PREFIX are virtual labels synthesized at query time. The small ones (FEED_SOURCE, CATEGORY) can be listed directly; reach the prefix labels through an edge (ANNOUNCED_BY, BELONGS_TO) rather than scanning them.

Do not anchor on an organization's display name. ORGANIZATION names are stored normalized and lowercase, so the string on a WHOIS record is not the key. Measured 2026-08-09 against production: {name: "Cloudflare, Inc."} returns zero rows at HTTP 200 with no error, while {name: "stripe"} — the stored form — returns its row in 4 ms. Reach an organisation through an edge first (REGISTERED_BY from a hostname, IP or ASN), read the name off that row, and use that as your anchor. A zero-row result on an ORGANIZATION name lookup is almost always the casing, not an absence of data.

Three labels are listable but unjoinable, and the difference matters before you write the query. RDAP_ENTITY, DNS_ROOT_INSTANCE and DWI_DOMAIN hold no edge of any type — by expanding an anchored node in both directions, and confirmed against the generated connection census, in which no edge type reaches any of the three. They can be counted and read property by property; the traversal into or out of them cannot be written at all. BGP_PATH_OBSERVATION is not in this group: it is reached over BGP_PATH.

Most labels carry only name. Threat-listed indicators, announced prefixes, ASNs, and ROAs carry richer, queryable properties.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. whisper.explain does not return coverage at all. Full contract: Coverage — what we looked at.

Threat & verdict (on threat-listed IPV4 / IPV6 / HOSTNAME)

Boolean flags — 20 of them, measured on a listed node on 2026-08-09: isThreat, isAnonymizer, isC2, isMalware, isPhishing, isSpam, isBruteforce, isScanner, isBlacklist, isTor, isProxy, isVpn, isWhitelist, isReputation, isBotnet, isDga, isStateActor, isExfilDestination, isOfacSanctioned, isScam.

Curated well-known infrastructure (public resolvers like 8.8.8.8) carries an allowlisted flag, and its verdict surfaces (verdictLevel, threatLevel, isThreat) are clamped to benign. The raw threatScore is never clamped, so WHERE ip.threatScore > 5 still matches an allowlisted resolver.

// Triage an IP on the reconciled verdict (preferred over raw threatScore)
MATCH (ip:IPV4 {name: "185.220.101.1"})
RETURN ip.name, ip.verdictScore, ip.verdictLevel, ip.verdictBlocking, ip.isTor, ip.isAnonymizer
LIMIT 1

BGP enrichment (on ANNOUNCED_PREFIX)

ASN aggregate threat (on ASN)

RPKI (on ROA)

A ROA has no name. Its identity is the pair prefix + asn, and that is what you select and filter on.

Other enriched labels

LISTED_IN edges carry no queryable properties. The per-feed evidence behind a verdict (each feed's weight and first/last-seen timestamps) comes from explain(), which returns it as an inspectable sources array.

CALL db.labels() YIELD label RETURN label ORDER BY label

db.labels() lists every node label with its count, and it answers immediately. Checking it first is the fastest cure for the most common mistake — anchoring on a label that doesn't exist and getting silent empty results.

CALL db.propertyKeys() and CALL db.schema.nodeTypeProperties() show the live property set, but use them to discover, not to enumerate: nodeTypeProperties() under-reports. Measured 2026-08-09, it lists 8 of IPV4's 20 boolean flags, and nothing beyond name / label / nodeId for TOR_RELAY, TLS_FINGERPRINT, CT_OBSERVATION, VENDOR and ROA — including for ROA, which does not carry a name at all. When you need the full set for one node, return the node itself and read the keys off the response.