Use casesThreat investigation
Only in WhisperThreat intelligence

Time Machine

Indicator → WHOIS/BGP state diff between its two most recent snapshots.

LayershistoricalWHOISBGP
  • 36 historical snapshot(s) for google.comwhisper.history
  • 2 change(s) between the two latest snapshots: Expiry date, Create datewhisper.history
What changed (latest vs previous)2 rows
fieldfromto
Expiry date2026-01-292028-09-13
Create date2006-01-291997-09-15
Snapshot timeline36 rows
queryTimeregistrarregistrantnameServersexpiryDate
2025-01-07 00:39:43MarkMonitor, Inc.Google LLCns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com2028-09-13
2024-12-26 18:45:16MarkMonitor, Inc.Google LLCns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com2026-01-29
2024-12-21 12:42:01MarkMonitor, Inc.Google LLCns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com2028-09-13
2024-12-19 09:45:56MarkMonitor, Inc.Google LLCns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com2028-09-13
2024-11-05 21:15:21MarkMonitor, Inc.Google LLCns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com2028-09-13
2024-09-13 03:45:03MarkMonitor, Inc.Google LLCns1.google.com|ns2.google.com|ns3.google.com|ns4.google.com2028-09-13
+30 more in the full run
The one query behind this
CALL whisper.history($indicator)

Snapshot from a max-depth run on Jun 26, 2026. Run it again for live data. time-machine

Try this in Console

Free tier — no credit card. Runs up to 3 hops deep; Pro goes to 5.

What it solves

Knowing that something changed is easy; knowing what changed, and when, usually means digging through history exports. This puts the before and after side by side.

The run pulls the last two recorded states for the indicator and diffs them, so a registrar swap, a new nameserver, or a routing change reads at a glance.

The old way3 tools / tabs25 min

Pull two history exports and eyeball the differences.

  • historical WHOIS
  • BGP archives
  • manual diffing

Dig deeper

Read the how-to

The documentation for this flow — the queries explained, with variants you can adapt.

Open the documentation →