Skip to content
DomainTools Technical Documentation

Domain History panel

The Domain History panel shows how a domain has evolved over time, tracking changes to WHOIS data, DNS records, web content, screenshots, and SSL certificates. It replaces the legacy Hosting History service with broader coverage across all domains tracked by DomainTools.

What’s tracked

Section titled “What’s tracked”

Domain History monitors changes to these data elements:

Data ElementDescription
StatusWhen DomainTools sees a domain as newly active, or when we’ve successfully resolved a domain to an A, MX, or NS in DNS within the last 10 days
WHOIS dataCreate/expiration dates, registrar and registrant names, contact emails, and more
DNS dataResults of daily DNS resolutions for A, NS, MX and SOA active resolutions
Web contentWebsite title, response code, server type, trackers, and more
ScreenshotsThe date/time when a new screenshot is captured
SSL Certificate updatesThe SHA 1 hash, validity dates, Issuer Common Name, and up to the first 5 Subject Alt Names

How it works

Section titled “How it works”

The system tracks each data element for differential changes and generates records when a value in a tracked field changes.

Visual indicators

Section titled “Visual indicators”
  • Green shading: Newly added elements
  • Short vertical bar: Marks new elements
  • No special formatting: Unchanged elements

This makes it easy to scan the timeline and identify when changes occurred.

Filter by category

Section titled “Filter by category”

Filter the Domain History display by primary and secondary categories:

  1. Select the gear icon on the left of the Domain History panel title bar.
  2. Open Domain History: Fields Settings.
  3. Choose which categories to display.
  4. Select Save.

Toggle visibility of filtered categories using the Field button in the panel’s column rows.

Coverage

Section titled “Coverage”

Domain History is available for:

  • Over 98% of active domains
  • All domains created since 2021

For additional historical information:

  • Legacy Hosting History Data Panel (via the Investigate UX)
  • 20+ years of records in the WHOIS History Data Panel

Use Domain History

Section titled “Use Domain History”

Track infrastructure changes

Section titled “Track infrastructure changes”

Monitor how a domain’s infrastructure evolves:

  • IP address changes: Identify hosting migrations
  • Name server changes: Track DNS provider changes
  • MX record changes: Monitor email infrastructure
  • SSL certificate updates: Track certificate renewals or changes

Identify suspicious patterns

Section titled “Identify suspicious patterns”

Look for patterns that may indicate malicious activity:

  • Rapid changes: Frequent infrastructure changes may indicate evasion
  • Hosting hops: Moving between hosting providers
  • Certificate changes: Unusual SSL certificate patterns
  • Content changes: Website title or server type modifications

Investigate campaigns

Section titled “Investigate campaigns”

Track the lifecycle of threat campaigns:

  • Initial setup: When infrastructure was established
  • Active period: Duration of activity
  • Takedown or abandonment: When infrastructure changed or went offline

Compare with other panels

Section titled “Compare with other panels”

Domain History complements other panels:

vs. WHOIS History : Domain History shows differential changes across all tracked fields : WHOIS History provides complete historical WHOIS records

vs. pDNS : Domain History shows when DNS records changed : pDNS provides detailed resolution history with timestamps

vs. Screenshot History : Domain History indicates when screenshots were captured : Screenshot History displays the actual screenshots

Best practices

Section titled “Best practices”

Efficient analysis

Section titled “Efficient analysis”
  1. Scan for green highlights: Focus on changed elements.
  2. Look for patterns: Identify clusters of changes.
  3. Cross-reference dates: Compare with other intelligence sources.
  4. Filter strategically: Show only relevant categories.

Investigation workflow

Section titled “Investigation workflow”
  1. Review Domain Profile: Get current state.
  2. Open Domain History: Identify changes over time.
  3. Investigate changes: Use other panels for details.
  4. Document timeline: Note significant changes in search notes.

What to look for

Section titled “What to look for”

Legitimate patterns:

  • Gradual, planned infrastructure changes
  • Consistent hosting and DNS providers
  • Regular SSL certificate renewals
  • Stable web content

Suspicious patterns:

  • Rapid, frequent changes
  • Hosting provider hopping
  • Unusual SSL certificate patterns
  • Inconsistent web content
  • Changes correlating with threat intelligence

Limitations

Section titled “Limitations”
  • Historical data availability depends on DomainTools’ data collection history
  • Very old domains may have incomplete historical records
  • Some changes may not be captured if they occur between collection intervals

See also

Section titled “See also”