Domain Hijacking Monitor — Nameserver Change Alerts

Watches a list of domains and tells you when their nameservers change in the registry zone.

An unexpected delegation change is the classic sign of a domain hijack: whoever controls the nameservers controls the mail, the website and the certificates. This is the signal most monitoring tools cannot see, because it lives in the registry's zone file rather than in anything you can query from outside.

Coverage

1,075 gTLDs, including .com, .net, .org, .info, .biz, .xyz, .top, .shop, .online, .site, .store, .app, .dev and .cloud — 255,631,856 delegated domains, counted from the zone files themselves and refreshed daily.

Coverage is real but it is not evenly spread, and you should know the shape of it before you rely on it: .com alone is 166 million of that total, and while all 1,075 TLDs are included, 481 of them hold fewer than a thousand domains each. Breadth helps you catch something in an obscure TLD; it is not 1,075 equally busy namespaces.

Not covered: .io, .ai, .co, .me, .tv, .cc and every other country-code TLD. These are not available from ICANN's zone file service at any price — they are run outside ICANN's contracts. They are also exactly the TLDs a startup expects, so we say it here rather than letting you find out from an empty result.

What a zone file does not contain, and no run will ever return: the registrant, their email, the registrar, the registration date, the expiry date, or the domain's own A, MX and TXT records. Any tool promising those needs a different source, and at scale that source is prohibited by the agreement behind this data.

Input

Every run is anchored on something you provide. There is no way to ask this Actor for the whole namespace, and that is a design decision rather than a limitation: the data agreement behind it forbids handing over a substantial portion of a zone, so the product simply has no shape that could.

See Example runs below for fifteen worked inputs.

Output

Field	Meaning
domain	The domain whose delegation changed
tld	Its top-level domain
observed_on	The date of the snapshot where the change appeared
nameservers	Where it delegates now
previous_nameservers	Where it delegated before
change_type	provider_change when the DNS operator changed, nameserver_change when the same operator moved servers
dns_provider	Who runs the DNS now
parked_for_sale	True when the new nameservers belong to a parking or domain-sale service. A delegation that moves to one of those usually means the owner is selling, not that anything was hijacked

Reading the results

The delegation fact is 100% reliable. These nameservers were in yesterday's snapshot and different ones are in today's. That is the registry's own record, not an inference.

What it means is up to you. A change you made yourself is a change. Read change_type first: nameserver_change inside the same provider is usually routine maintenance, while provider_change on a domain you did not migrate is the one worth waking someone up for.

One snapshot a day. A hijack at 09:00 shows up in tomorrow's run. That is still far earlier than most organisations notice, but it is not real-time and we will not pretend otherwise.

Scope. This Actor is built for monitoring what you are responsible for: your own portfolio, your clients', or infrastructure you are investigating. The optional provider filter is always bounded by the look-back window, which is capped at 90 days, and every response carries a hard row cap.

dns_provider says who runs the DNS, not what the site is built with. The nameserver identifies the DNS operator for 69% of domains, but a domain on Cloudflare can be running anything. Website platforms are configured with A and CNAME records, which a zone file does not contain, so we cannot see them and we do not guess.

An empty result is the good news: nothing you are watching changed hands. It only costs the $0.00001 start fee.

Example runs

1. Monitor a small company domain portfolio daily

{
  "domains": [
    "alabamapayroll.com",
    "ecopayroll.com",
    "agileinvoice.com"
  ],
  "days": 30,
  "maxResults": 100
}

2. Watch client domains for nameserver changes

{
  "domains": [
    "abit-consulting.net",
    "5fold.agency",
    "abfmarketingconsulting.com"
  ],
  "days": 30,
  "maxResults": 500
}

3. Weekly nameserver change check on a portfolio

{
  "domains": [
    "invoicecorp.com",
    "invoicefix.com",
    "invoice-snap.com",
    "invoiced.org"
  ],
  "days": 30,
  "maxResults": 1000
}

4. Investigate a domain after a suspected hijack

{
  "domains": [
    "aldentalclinic.com"
  ],
  "days": 30,
  "maxResults": 100
}

5. Monitor finance and payroll domains for hijacking

{
  "domains": [
    "alabamapayroll.com",
    "digitinvoice.com"
  ],
  "days": 30,
  "maxResults": 100
}

6. Watch an acquired company domains for changes

{
  "domains": [
    "carillonuniversity.com",
    "carillonerpuniversity.com"
  ],
  "days": 30,
  "maxResults": 200
}

7. Verify a DNS migration completed correctly

{
  "domains": [
    "alltranslogistics.com"
  ],
  "days": 30,
  "maxResults": 50
}

8. Registrar audit of nameserver changes

{
  "provider": [
    "registrar-servers.com"
  ],
  "days": 7,
  "maxResults": 1000
}

9. Research delegation changes on one DNS provider

{
  "provider": [
    "dnsmadeeasy.com"
  ],
  "days": 7,
  "maxResults": 1000
}

10. Track a DNS migration you are running

{
  "provider": [
    "domaincontrol.com"
  ],
  "days": 30,
  "maxResults": 2000
}

11. Incident response with 90 days of history

{
  "domains": [
    "a1specialtyclinic.com"
  ],
  "days": 90,
  "maxResults": 500
}

12. Monitor a university domain estate

{
  "domains": [
    "achasuniversity.com",
    "aksuniversity.info"
  ],
  "days": 30,
  "maxResults": 500
}

13. Watch government supplier domains for changes

{
  "domains": [
    "agensupplyltd.com",
    "amadasupply.com"
  ],
  "days": 30,
  "maxResults": 500
}

14. Monitor a large asset list from a CMDB export

{
  "domains": [
    "3msupplyus.com",
    "achmlogistics.com",
    "adroitlogisticsllc.com"
  ],
  "days": 30,
  "maxResults": 5000
}

15. Monthly delegation change report for an estate

{
  "domains": [
    "carismauniversity.com",
    "cgnuniversity.com"
  ],
  "days": 30,
  "maxResults": 5000
}

Pricing

$0.00001 to start, then $0.004 per delegation change — about $4 per 1,000 results.

Priced for the shape it is meant to have: a daily scheduled run over a watchlist that returns nothing most days and costs essentially nothing. You pay only when something actually moved, which is the day you wanted to be told.

Data source

🛡️ Sourced from the Registry Operators' own zone files, obtained through ICANN's Centralized Zone Data Service under agreement with those operators. ICANN does not endorse, sponsor or review this Actor.

Built for security research, brand protection and domain analytics. The access behind this data was granted one TLD at a time, which is why the coverage is what it is.

Support

Found a domain the Actor missed, or a row that looks wrong? Open an issue on the Actor page with the exact input you used. Zone data is refreshed once a day, so a domain delegated this morning may not appear until tomorrow's snapshot.