Domain History Checker

Research the public history of any domain before you buy, redirect, onboard, or trust it. Domain History Checker combines RDAP registration data, Wayback Machine archive history, URLHaus malware records, ThreatFox IOC records, and DNS blacklist lookups into one structured Apify dataset.

Use it to answer practical domain due-diligence questions: how old is this domain, what did it host before, did it ever appear in malware or phishing feeds, and do public DNS blocklists currently flag it?

What does Domain History Checker do?

Domain History Checker normalizes one or more domains, runs public history and reputation checks, and returns one row per domain.

It checks:

• RDAP registration data: registrar, creation date, expiry date, last changed date, status flags, and domain age
• Wayback Machine history: first snapshot, latest snapshot, and archive activity span
• URLHaus: historical and active malware URLs associated with the domain
• ThreatFox: IOC records associated with the domain
• DNS blacklists: public domain blacklist lookups across supported lists
• combined risk fields: isClean, riskLevel, and source-specific counts

No API keys, browser automation, proxy, account login, registrar access, or DNS dashboard access is required.

Why use this domain history checker?

Use case	How it helps
Expired domain due diligence	Check whether a domain had malware, phishing, spam, or suspicious archive history before buying it.
SEO domain vetting	Compare RDAP age and Wayback history against seller claims about domain age and previous niche.
Vendor and partner checks	Screen supplier or customer domains before connecting them to workflows.
Security triage	Turn public threat-intel sources into a single row analysts can review quickly.
Portfolio monitoring	Run batches of owned or watched domains and export clean, structured history data.

What data does it return?

Field	Description
domain	Normalized root domain that was checked.
isClean	true when no URLHaus, ThreatFox, or DNS blacklist flags were found.
riskLevel	low, medium, or high based on how many threat-source categories flagged the domain.
registrar, registrarCountry	Registrar information from RDAP when available.
privacyProtected	Whether RDAP signals privacy/proxy/redacted registrant data.
registrationDate, expirationDate, lastChangedDate	RDAP lifecycle dates when exposed.
domainAgeDays, domainStatus	Calculated domain age and RDAP status flags.
hasWaybackHistory	Whether the Internet Archive has snapshots for the domain.
waybackFirstSeen, waybackLastSeen, waybackYearsActive	Archive history range and approximate active years.
urlhausFound, urlhausUrlsCount, urlhausActiveCount	URLHaus malware-history indicators.
urlhausUrls	Up to 10 URLHaus records with URL, status, threat, and date details.
threatFoxFound, threatFoxIocCount	ThreatFox IOC indicators.
threatFoxIocs	Up to 5 IOC records with threat, malware, confidence, and dates.
domainBlacklists, domainBlacklistCount	Per-list DNS blacklist results and total confirmed hits.

How do I run Domain History Checker?

1. Add domains to Domains to Check. You can paste roots such as example.com or messy inputs such as https://www.example.com/path.
2. Start the Actor.
3. Review riskLevel, isClean, URLHaus, ThreatFox, Wayback, and RDAP fields.
4. Export the dataset as JSON, CSV, Excel, or read it through the Apify API.

For a first test, check one known domain. For batches, start small and increase gradually because external public APIs can rate-limit or respond slowly.

What input does it accept?

{
  "domains": ["example.com", "https://www.oldsite.com/page"],
  "datasetId": "",
  "runId": "domain-history-batch-2026-08-17"
}

Input	Type	Required	Description
domains	Array of strings	No	Domains to check. The Actor normalizes protocol, www, paths, and trailing slashes to a root domain. Examples: example.com, https://www.example.org/page.
datasetId	String	No	Existing Apify dataset ID to append results to in addition to the default run dataset. Leave empty to write only to the run dataset.
runId	String	No	Optional workflow or parent run ID copied into each output row for pipeline tracing.

What output should I expect?

{
  "domain": "example.com",
  "isClean": true,
  "riskLevel": "low",
  "registrar": "RESERVED-Internet Assigned Numbers Authority",
  "registrarCountry": null,
  "privacyProtected": false,
  "registrationDate": "1995-08-14T04:00:00Z",
  "expirationDate": "2026-08-13T04:00:00Z",
  "lastChangedDate": "2025-08-14T07:01:44Z",
  "domainAgeDays": 11326,
  "domainStatus": ["active"],
  "hasWaybackHistory": true,
  "waybackFirstSeen": "1996-12-12",
  "waybackLastSeen": "2026-08-01",
  "waybackYearsActive": 29.6,
  "urlhausFound": false,
  "urlhausUrlsCount": 0,
  "urlhausActiveCount": 0,
  "urlhausUrls": [],
  "threatFoxFound": false,
  "threatFoxIocCount": 0,
  "threatFoxIocs": [],
  "domainBlacklists": {
    "SURBL Multi": false,
    "URIBL Multi": false,
    "NordSpam DBL": false,
    "MSRBL Phishing": false,
    "MSRBL Spam": false
  },
  "domainBlacklistCount": 0,
  "runId": "domain-history-batch-2026-08-17"
}

Dates, archive history, registrar fields, and blacklist availability depend on public source responses at run time.

How can I use it through the Apify API?

curl -X POST "https://api.apify.com/v2/acts/trovevault~domain-history-checker/runs" \
  -H "Authorization: Bearer <APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["example.com", "oldsite.com"],
    "runId": "domain-history-batch-2026-08-17"
  }'

Read the default dataset after the run finishes, or pass datasetId to append rows into a shared due-diligence dataset.

How should I interpret risk?

Signal	Meaning
riskLevel: "low"	No URLHaus, ThreatFox, or DNS blacklist hit was found. Still review RDAP and Wayback context.
riskLevel: "medium"	One threat-source category flagged the domain. Analyst review is recommended.
riskLevel: "high"	Two or more threat-source categories flagged the domain. Treat the domain as risky until manually reviewed.
urlhausActiveCount > 0	URLHaus reports active malware URLs for the domain. This is a strong warning sign.
No Wayback history	Not automatically bad; it may mean the domain is new, low-traffic, blocked from archiving, or not crawled.

This Actor provides public evidence, not a final security verdict.

How much does it cost?

Domain History Checker uses Apify pay-per-event pricing. Runtime depends on the number of domains and public-source response speed.

Cost controls:

• test with one or two domains before running a large list
• split large domain portfolios into smaller batches
• retry slow or incomplete runs later instead of raising batch size immediately
• use datasetId to merge several small runs into one dataset

How do I troubleshoot common issues?

Issue	Likely cause	What to do
No domains were checked	The domains array was empty or contained only blank values.	Add at least one root domain such as example.com.
RDAP fields are null	The TLD, registry, or RDAP gateway did not return registration data.	Keep the threat-intel fields and retry later if registration data matters.
Wayback has no history	The domain may be new, low-traffic, blocked from archiving, or never crawled.	Review RDAP age and other sources before drawing conclusions.
DNS blacklist value is null	The DNSBL query was unavailable, blocked, or returned an ambiguous response.	Treat null as unavailable, not clean or listed. Retry later.
Sources disagree	Public threat feeds have different coverage and retention windows.	Review source-specific fields instead of relying only on riskLevel.

What are the limitations?

• It uses public RDAP, Internet Archive, URLHaus, ThreatFox, and DNS blacklist lookups only.
• It does not access registrar accounts, hosting dashboards, private WHOIS history, paid SEO databases, or private threat-intel feeds.
• Public sources may rate-limit, omit records, change APIs, or return partial data.
• A clean result does not prove a domain was always safe; it means these public checks did not find a flag during the run.
• This Actor is for due diligence and workflow automation, not legal, cybersecurity, SEO, or investment advice.

FAQ

What is the difference between Domain History Checker and Domain Security Scanner?
Domain History Checker focuses on past and historical evidence. Domain Security Scanner focuses more on current active threat signals.

Can I check domains I do not own?
Yes. The Actor uses public lookup sources and does not require domain ownership.

Can I use it for expired domain buying?
Yes. It is useful for spotting malware history, suspicious archive history, or registration-age mismatch before buying a domain.

Does isClean: true mean the domain is safe?
No. It means URLHaus, ThreatFox, and supported DNS blacklist checks did not find a flag during this run. Always review the context fields.

Support

Open an issue on the Actor page with the input JSON, run ID, domain checked, and the field that looks wrong or incomplete.