How to check a domain's history before you buy it?

To check a domain's history before you buy it, look up its past content in the Wayback Machine, check its registration dates and status with an RDAP lookup, test it against spam and malware blacklists, review its backlink profile with an SEO tool, and search certificate transparency logs and search results for past use. Also check for trademark conflicts and, if possible, ask the seller for Search Console access. Together these checks show whether the domain was used for spam, scams or adult content, whether it carries penalties, and whether its past will help or hurt you.

A previously registered domain can come with valuable backlinks and type-in traffic, or with a spam reputation that takes months to clear. Problems are much cheaper to discover before you pay than after. This guide walks through each check in a sensible order, with commands and scripts you can run yourself, and ends with a checklist you can use for any domain purchase.

Why Domain History Matters

When you buy a used domain, you inherit how the rest of the internet sees it:

• Search engines may still associate it with old content, links or manual actions.
• Email providers may have the domain on reputation lists if it was used to send spam.
• Security services may still flag it if it once hosted malware or phishing pages.
• People may remember it for something you don't want to be connected with.
• Trademark owners may have a claim if it was previously used to imitate a brand.

None of these appear in the domain name itself, so you need to look for them.

Check 1: Registration History

Start with the basic registration data. An RDAP lookup tells you when the current registration began, when it expires and its current status. See what RDAP is for how the protocol works.

curl -sL https://rdap.org/domain/example.com \
  | jq '{status, events: [.events[] | {eventAction, eventDate}]}'

{
  "status": [
    "client transfer prohibited"
  ],
  "events": [
    { "eventAction": "registration", "eventDate": "2023-01-19T22:10:35Z" },
    { "eventAction": "expiration", "eventDate": "2027-01-19T22:10:35Z" },
    { "eventAction": "last changed", "eventDate": "2026-07-04T15:51:02Z" }
  ]
}

What to look for:

• Registration date: This is the date of the current registration, not the first one ever. If the domain dropped and was re-registered, the date resets. A recent registration date on a domain the Wayback Machine shows as active for years means it has changed hands through expiry.
• Recent changes: A "last changed" date close to the sale may mean the seller just acquired it.

Public registration data only shows the present. Several commercial services sell historical WHOIS records, which show previous registrants (where they weren't privacy-protected), registrars and nameservers over time. These are useful for spotting a domain that's been bounced between many owners, a common sign of spam use. For background, read what WHOIS is.

Check 2: Archived Content in the Wayback Machine

The Internet Archive's Wayback Machine stores snapshots of web pages going back to the 1990s. Visit web.archive.org and enter the domain to browse its timeline.

You can also query the archive's CDX API to get a compact summary. This lists one capture per year with its HTTP status:

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com&output=json&fl=timestamp,statuscode,original&collapse=timestamp:4"

[["timestamp","statuscode","original"],
["20090412083107","200","http://example.com/"],
["20120118120455","200","http://www.example.com/"],
["20160903041210","200","http://example.com/"],
["20190722190844","302","http://example.com/"],
["20230215101933","200","https://example.com/"]]

The collapse=timestamp:4 parameter keeps one result per distinct year. Change it to timestamp:6 for one per month. Open interesting snapshots in your browser using this pattern:

https://web.archive.org/web/20160903041210/http://example.com/

What to look for:

• Topic changes: A florist site that becomes a casino affiliate site suggests the domain was bought for its links.
• Spam patterns: Pages stuffed with keywords, foreign-language pharmacy or loan content, or thousands of auto-generated pages.
• Adult, gambling or counterfeit goods content.
• Phishing pages imitating a bank, payment provider or brand.
• Gaps: Long periods with no captures, or only parked pages, often indicate expiry and re-registration.

You can also count how many unique URLs the archive has seen. A small business site with tens of thousands of archived URLs is a warning sign:

curl -s "https://web.archive.org/cdx/search/cdx?url=example.com/*&fl=original&collapse=urlkey&limit=50000" | wc -l

Check 3: Blacklists and Security Reputation

Domain Blocklists

Email providers and security tools use DNS-based blocklists. The Spamhaus Domain Block List (DBL) is one of the most widely used. You query it by prepending the domain to the list's zone:

dig +short example.com.dbl.spamhaus.org

No output means the domain isn't listed. A response in the 127.0.1.x range means it is, with the last number indicating the reason (spam, phishing, malware and so on). Spamhaus blocks queries made through large public resolvers such as 8.8.8.8 and returns an error code instead, so run this from a network with its own resolver, or use Spamhaus's website lookup. If you need help reading dig output, see how to use the dig command.

Other places to check:

• Spamhaus and other providers' web lookups, which also show past listings and removal guidance.
• Google Safe Browsing, through Google's Transparency Report site status page.
• VirusTotal, which aggregates results from many security vendors and shows past detections.
• Microsoft and other mailbox provider postmaster tools, once you control the domain.

Certificate Transparency Logs

Every publicly trusted SSL/TLS certificate is recorded in certificate transparency logs. Searching them shows which subdomains had certificates and when, which can reveal past services and suspicious names:

curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r '.[] | [.not_before[0:10], .name_value] | @tsv' \
  | sort -u | head -n 20

2019-03-02 www.example.com
2021-06-14 mail.example.com
2021-06-14 shop.example.com
2022-11-30 login-secure.example.com
2022-11-30 paypal-verify.example.com

In this example, subdomains imitating a payment brand suggest the domain was used for phishing. The %25 is a URL-encoded % wildcard, so the query matches all subdomains. For more about certificates, see what an SSL/TLS certificate is.

Check 4: Backlinks

Backlinks can be the most valuable thing about an old domain, or the most toxic. Use an SEO tool such as Ahrefs, Semrush, Majestic or Moz to review:

• Number of referring domains: How many different websites link to it.
• Quality: Links from real, relevant sites are an asset. Links from link farms, comment spam, hacked sites and unrelated foreign-language pages are a liability.
• Anchor text: Natural profiles have mostly brand names and URLs. A profile dominated by anchors such as "cheap loans" or "buy viagra" points to past spam.
• Link velocity: Sudden spikes of thousands of links in a short period suggest manipulation.
• Topic match: Links about the same subject as your planned site are more useful than links about something unrelated.

If the domain's backlinks look unnatural and you still want it, plan to disavow the worst ones after purchase, and expect it to take time for search engines to reassess the site.

Check 5: Search Engine Signals

Is the Domain Indexed?

Search for site:example.com in Google and Bing. Results tell you whether the domain currently has indexed pages and what they're about. Zero results for a domain with a live site and plenty of backlinks may hint at a penalty or a technical block, although it isn't proof either way.

Also search for the bare domain name in quotes, "example.com", to find forum posts, scam warnings, news articles and reviews mentioning it.

Ask for Search Console Access

If the seller has been running a site on the domain, ask them to add you as a user in Google Search Console or share screenshots of:

• Manual actions: Any penalty applied by Google's reviewers.
• Security issues: Hacked content or malware warnings.
• Performance: Clicks and impressions over the past 16 months.

A seller who refuses to share any of this for a high-priced domain is giving you useful information too. After you buy, verify the domain in Search Console yourself with a DNS TXT record, as described in how to verify domain ownership with a TXT record, and check these reports straight away.

Check 6: Current DNS and Email Setup

Look at the domain's current DNS to see how it's being used now and whether anything will need cleaning up:

dig +short example.com NS
dig +short example.com A
dig +short example.com MX
dig +short example.com TXT

Things to note:

• Parking or marketplace nameservers usually mean an investor owns it. See what domain parking is.
• MX records mean the domain may currently receive email. After you buy it, old contacts may still send messages, including password resets for the previous owner's accounts. Don't use these to access anyone else's accounts.
• Verification TXT records reveal which services the previous owner used.

For a full guide to inspecting records, read how to check DNS records.

Check 7: Trademarks and Brand Conflicts

A domain that matches or closely resembles a trademark can attract a dispute, even if you bought it in good faith. Search:

• National trademark databases, such as the USPTO in the United States, the UK IPO, or EUIPO for EU trademarks.
• WIPO's Global Brand Database, which covers many countries.
• Business registers and a general web search for companies trading under the name.

If a well-known brand uses the name in your industry, think carefully. You may face a UDRP complaint or a legal letter, and your new site could be seen as imitating them.

Putting It Together: A Quick Script

This Python script runs a few of the automated checks in one go: registration dates, the earliest Wayback capture and certificate transparency subdomains. It's a starting point, not a substitute for looking at the results yourself.

import sys
import requests

domain = sys.argv[1] if len(sys.argv) > 1 else "example.com"
session = requests.Session()
session.headers["User-Agent"] = "domain-history-check/1.0"

# 1. Registration data via RDAP
rdap = session.get(f"https://rdap.org/domain/{domain}", timeout=20)
if rdap.ok:
    events = {e["eventAction"]: e["eventDate"] for e in rdap.json().get("events", [])}
    print(f"Registered: {events.get('registration', 'unknown')}")
    print(f"Expires:    {events.get('expiration', 'unknown')}")
else:
    print(f"RDAP lookup returned HTTP {rdap.status_code}")

# 2. Earliest Wayback Machine capture
cdx = session.get(
    "https://web.archive.org/cdx/search/cdx",
    params={"url": domain, "output": "json", "fl": "timestamp", "limit": 1},
    timeout=30,
)
rows = cdx.json() if cdx.ok and cdx.text.strip() else []
print(f"First archived: {rows[1][0] if len(rows) > 1 else 'no captures'}")

# 3. Subdomains seen in certificate transparency logs
ct = session.get("https://crt.sh/", params={"q": f"%.{domain}", "output": "json"}, timeout=60)
names = set()
if ct.ok:
    for entry in ct.json():
        names.update(entry["name_value"].splitlines())
print(f"Names in CT logs ({len(names)}):")
for name in sorted(names)[:25]:
    print(f"  {name}")

Registered: 2023-01-19T22:10:35Z
Expires:    2027-01-19T22:10:35Z
First archived: 20090412083107
Names in CT logs (5):
  login-secure.example.com
  mail.example.com
  paypal-verify.example.com
  shop.example.com
  www.example.com

Here, the first archive capture from 2009 alongside a 2023 registration date confirms the domain expired and was re-registered at some point, which is exactly when to look closely at the archive for that period. The crt.sh service can be slow or time out for busy domains, so retry later if it fails.

Domain History Checklist

[ ] RDAP: registration date, expiry date and status recorded
[ ] Historical WHOIS reviewed (if available) for frequent ownership changes
[ ] Wayback Machine: content reviewed across all years, no spam, scams or adult content
[ ] Blocklists: Spamhaus DBL, Safe Browsing and VirusTotal clean
[ ] Certificate transparency: no suspicious subdomains
[ ] Backlinks: natural anchors, relevant referring sites, no spikes
[ ] site: search shows expected indexing, no scam warnings online
[ ] Search Console manual actions and security issues checked (or requested)
[ ] Current DNS and MX records noted for clean-up
[ ] Trademark databases searched for conflicts

What to Do If You Find Problems

• Minor spam links: Often manageable. Disavow the worst links after purchase and build quality content.
• Old blacklist listings that have expired: Usually fine, but check again just before you buy.
• Current blacklist listings: Find out whether removal is possible and how long it takes, and factor that into the price.
• Manual actions: You can file a reconsideration request after cleaning up, but there's no guarantee of a quick result.
• Phishing or malware history: Treat with caution. Reputation recovery can be slow, and email deliverability may suffer.
• Trademark conflicts: Usually a reason to walk away.

Use what you find in negotiations. A domain with a messy history is worth less, and a seller who knows about the problems should expect a lower offer. If the history is clean and you decide to proceed, complete the deal safely through domain escrow.

---

FAQ: Checking Domain History

---

Conclusion

Checking a domain's history takes an hour or two, and it can save you from buying a name that's blacklisted, penalised or tied to scams. Start with the registration data and the Wayback Machine to understand who used it and how, then look at blacklists, certificate transparency logs, backlinks, search results and trademarks to fill in the picture.

No single check tells the whole story, so combine them and look for patterns. A clean, consistent history is a good sign and worth paying for. A messy one isn't always a deal-breaker, but it should lower the price and come with a clear plan for clean-up once the domain is yours.