# Domain Hijacking Monitor — Nameserver Change Alerts (`oswaldocarabano/delegation-change-monitor`) Actor

Domain hijacking monitor: watch your domains and get alerted when their nameservers change in the registry zone. An unexpected delegation change is the classic sign of domain theft, and it lives in the zone file where ordinary domain monitoring services cannot see it.

- **URL**: https://apify.com/oswaldocarabano/delegation-change-monitor.md
- **Developed by:** [Oswaldo Carabano](https://apify.com/oswaldocarabano) (community)
- **Categories:** Developer tools, AI, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Domain Hijacking Monitor — Nameserver Change Alerts

Watches a list of domains and tells you when their nameservers change in the registry
zone.

An unexpected delegation change is the classic sign of a **domain hijack**: whoever
controls the nameservers controls the mail, the website and the certificates. This is
the signal most monitoring tools cannot see, because it lives in the registry's zone
file rather than in anything you can query from outside.

### Coverage

**1,075 gTLDs**, including `.com`, `.net`, `.org`, `.info`, `.biz`, `.xyz`, `.top`,
`.shop`, `.online`, `.site`, `.store`, `.app`, `.dev` and `.cloud` — **255,631,856
delegated domains**, counted from the zone files themselves and refreshed daily.

Coverage is real but it is not evenly spread, and you should know the shape of it
before you rely on it: `.com` alone is 166 million of that total, and while all 1,075
TLDs are included, 481 of them hold fewer than a thousand domains each. Breadth helps
you catch something in an obscure TLD; it is not 1,075 equally busy namespaces.

**Not covered:** `.io`, `.ai`, `.co`, `.me`, `.tv`, `.cc` and every other country-code
TLD. These are not available from ICANN's zone file service at any price — they are run
outside ICANN's contracts. They are also exactly the TLDs a startup expects, so we say
it here rather than letting you find out from an empty result.

**What a zone file does not contain, and no run will ever return:** the registrant,
their email, the registrar, the registration date, the expiry date, or the domain's own
A, MX and TXT records. Any tool promising those needs a different source, and at scale
that source is prohibited by the agreement behind this data.

### Input

Every run is anchored on something you provide. There is no way to ask this Actor for
the whole namespace, and that is a design decision rather than a limitation: the data
agreement behind it forbids handing over a substantial portion of a zone, so the
product simply has no shape that could.

See **Example runs** below for fifteen worked inputs.

### Output

| Field | Meaning |
|---|---|
| `domain` | The domain whose delegation changed |
| `tld` | Its top-level domain |
| `observed_on` | The date of the snapshot where the change appeared |
| `nameservers` | Where it delegates now |
| `previous_nameservers` | Where it delegated before |
| `change_type` | `provider_change` when the DNS operator changed, `nameserver_change` when the same operator moved servers |
| `dns_provider` | Who runs the DNS now |
| `parked_for_sale` | True when the **new** nameservers belong to a parking or domain-sale service. A delegation that moves to one of those usually means the owner is selling, not that anything was hijacked |

### Reading the results

**The delegation fact is 100% reliable.** These nameservers were in yesterday's
snapshot and different ones are in today's. That is the registry's own record, not an
inference.

**What it means is up to you.** A change you made yourself is a change. Read
`change_type` first: `nameserver_change` inside the same provider is usually routine
maintenance, while `provider_change` on a domain you did not migrate is the one worth
waking someone up for.

**One snapshot a day.** A hijack at 09:00 shows up in tomorrow's run. That is still far
earlier than most organisations notice, but it is not real-time and we will not pretend
otherwise.

**Scope.** This Actor is built for monitoring what you are responsible for: your own
portfolio, your clients', or infrastructure you are investigating. The optional
provider filter is always bounded by the look-back window, which is capped at 90 days,
and every response carries a hard row cap.

**`dns_provider` says who runs the DNS, not what the site is built with.** The
nameserver identifies the DNS operator for 69% of domains, but a domain on Cloudflare
can be running anything. Website platforms are configured with A and CNAME records,
which a zone file does not contain, so we cannot see them and we do not guess.

**An empty result is the good news**: nothing you are watching changed hands. It only costs the $0.00001 start fee.

### Example runs

**1. Monitor a small company domain portfolio daily**

```json
{
  "domains": [
    "alabamapayroll.com",
    "ecopayroll.com",
    "agileinvoice.com"
  ],
  "days": 30,
  "maxResults": 100
}
```

**2. Watch client domains for nameserver changes**

```json
{
  "domains": [
    "abit-consulting.net",
    "5fold.agency",
    "abfmarketingconsulting.com"
  ],
  "days": 30,
  "maxResults": 500
}
```

**3. Weekly nameserver change check on a portfolio**

```json
{
  "domains": [
    "invoicecorp.com",
    "invoicefix.com",
    "invoice-snap.com",
    "invoiced.org"
  ],
  "days": 30,
  "maxResults": 1000
}
```

**4. Investigate a domain after a suspected hijack**

```json
{
  "domains": [
    "aldentalclinic.com"
  ],
  "days": 30,
  "maxResults": 100
}
```

**5. Monitor finance and payroll domains for hijacking**

```json
{
  "domains": [
    "alabamapayroll.com",
    "digitinvoice.com"
  ],
  "days": 30,
  "maxResults": 100
}
```

**6. Watch an acquired company domains for changes**

```json
{
  "domains": [
    "carillonuniversity.com",
    "carillonerpuniversity.com"
  ],
  "days": 30,
  "maxResults": 200
}
```

**7. Verify a DNS migration completed correctly**

```json
{
  "domains": [
    "alltranslogistics.com"
  ],
  "days": 30,
  "maxResults": 50
}
```

**8. Registrar audit of nameserver changes**

```json
{
  "provider": [
    "registrar-servers.com"
  ],
  "days": 7,
  "maxResults": 1000
}
```

**9. Research delegation changes on one DNS provider**

```json
{
  "provider": [
    "dnsmadeeasy.com"
  ],
  "days": 7,
  "maxResults": 1000
}
```

**10. Track a DNS migration you are running**

```json
{
  "provider": [
    "domaincontrol.com"
  ],
  "days": 30,
  "maxResults": 2000
}
```

**11. Incident response with 90 days of history**

```json
{
  "domains": [
    "a1specialtyclinic.com"
  ],
  "days": 90,
  "maxResults": 500
}
```

**12. Monitor a university domain estate**

```json
{
  "domains": [
    "achasuniversity.com",
    "aksuniversity.info"
  ],
  "days": 30,
  "maxResults": 500
}
```

**13. Watch government supplier domains for changes**

```json
{
  "domains": [
    "agensupplyltd.com",
    "amadasupply.com"
  ],
  "days": 30,
  "maxResults": 500
}
```

**14. Monitor a large asset list from a CMDB export**

```json
{
  "domains": [
    "3msupplyus.com",
    "achmlogistics.com",
    "adroitlogisticsllc.com"
  ],
  "days": 30,
  "maxResults": 5000
}
```

**15. Monthly delegation change report for an estate**

```json
{
  "domains": [
    "carismauniversity.com",
    "cgnuniversity.com"
  ],
  "days": 30,
  "maxResults": 5000
}
```

### Pricing

**$0.00001 to start, then $0.004 per delegation change** — about **$4 per 1,000
results**.

Priced for the shape it is meant to have: a daily scheduled run over a watchlist that
returns **nothing** most days and costs essentially nothing. You pay only when
something actually moved, which is the day you wanted to be told.

### Data source

> 🛡️ **Sourced from the Registry Operators' own zone files**, obtained through ICANN's
> Centralized Zone Data Service under agreement with those operators. ICANN does not
> endorse, sponsor or review this Actor.

Built for security research, brand protection and domain analytics. The access behind
this data was granted one TLD at a time, which is why the coverage is what it is.

### Support

Found a domain the Actor missed, or a row that looks wrong? Open an issue on the Actor
page with the exact input you used. Zone data is refreshed once a day, so a domain
delegated this morning may not appear until tomorrow's snapshot.

# Actor input Schema

## `domains` (type: `array`):

The domains you want monitored, one per line. Up to 5,000. This is the normal way to use this Actor: your own portfolio, or your clients'.

## `provider` (type: `array`):

Optional. Instead of a domain list, report changes involving this DNS provider, matched on the nameserver hostname. Always bounded by the look-back window.

## `days` (type: `integer`):

How many days of daily snapshots to search. Required and capped at 90 — there is no "since forever", by design.

## `maxResults` (type: `integer`):

Hard cap on rows returned. Kept low on purpose so a first run cannot burn your free credit. Raise it deliberately. The service will never return more than 50,000 rows in one run.

## Actor input object example

```json
{
  "domains": [
    "example.com",
    "example.net"
  ],
  "provider": [],
  "days": 7,
  "maxResults": 100
}
```

# Actor output Schema

## `dataset` (type: `string`):

Domain hijacking monitor: watch your domains and get alerted when their nameservers change in the registry zone. An unexpected delegation change is the classic sign of domain theft, and it lives in the zone file where ordinary domain monitoring services cannot see it.

## `runSummary` (type: `string`):

How many rows matched, whether the row cap truncated the answer, and the date of the zone data used. If truncated is true, you are seeing a partial answer.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com",
        "example.net"
    ],
    "provider": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("oswaldocarabano/delegation-change-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": [
        "example.com",
        "example.net",
    ],
    "provider": [],
}

# Run the Actor and wait for it to finish
run = client.actor("oswaldocarabano/delegation-change-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com",
    "example.net"
  ],
  "provider": []
}' |
apify call oswaldocarabano/delegation-change-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,oswaldocarabano/delegation-change-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/PELJAYpGqyxhbM0Wc/builds/t5Sdkt0ITbTgayBsZ/openapi.json