Whois History
Overview
Whois History is a powerful investigative tool, allowing you to “look back in time” to spot significant changes in the ownership, hosting, registration, and other information about the domain. It is one of the premium tools available to DomainTools Personal and Enterprise members.
This document will help you understand and get the most from this powerful tool.
Layout
The Whois History page consists of three main sections:
the search and filter controls, the timeline, and the Whois record display. Where the earlier version displayed dates for all Whois records in the DomainTools
database for a given domain, the new layout, by default, highlights just those dates on which something changed in the Whois record. All records (including those without changes)
are still available, but do not clutter the screen.
The compact, expandable/collapsible timeline display allows you to simultaneously inspect the Whois record and navigate through time.
This will save considerable time in exploring the history of a domain and pinpointing key events.
Lookup and Filter Controls
The lookup box works as before – it is where you begin your exploration of a domain’s history.
Filtering is an important new function in the new Whois History tool. To use the filter, enter a string (examples could be a whole or partial registrant name,
organization name, physical address, phone number, etc.), which is known or suspected to be in the whois history. The timeline then displays only those Whois records
that include this string, if any. Clear the filter to return to the entire body of historical Whois records.
Timeline
The timeline highlights changes in the Whois records, and allows you to navigate forward and backward in the history of the domain. The dates initially shown
in the timeline are dates on which something changed in the Whois record. You can also click “more” to expose the duplicate records between the dates shown in the timeline.
If there are no records in the database between those dates, the “more” link is disabled.
The “Collapse All” button collapses the timeline down to just the years for which we have records, with an indication of how many changes (unique records) exist for that year.
In the collapsed view, this button becomes “Expand All”.
Viewing Changes in Whois Records
Seeing what changed from one record to the next is among the most important functions of Whois History. Click “changes” to see what changed on a given record. This opens a display of the before/after Whois records. There are three view options to choose from:
- “Side-by side Changes” shows the two Whois records side by side with changes highlighted;
- “In-line changes” shows a single page with just the changes shown next to each other, line over line;
- “Whois Records” just shows each Whois record (changes not highlighted).
Choose the view you prefer. You can use the right/left keyboard arrows, or click the arrows at the right or left margins of the display, to jump from one pair of records to the next pair of changed records. This can help you quickly find a specific type of change.
Spotting Whois Privacy
A symbol is displayed next to the date to indicate records where Whois privacy was used. This enables you to quickly scan the timeline to find a time when a domain was
not protected under Whois privacy controls.
Screenshots
The “screenshot” link displays a screenshot of the main page of the domain, if a website was active for the domain on that date and if the screenshot exists in the DomainTools database.
If the screenshot link is not available, you may be able to locate a screenshot within the group of identical records. Click “more” to show all the identical records in a group and scroll
down through the list to find a date with a “screenshot” link as close to your target date as possible.
You can also investigate directly using our Screenshot History tool.
Finding the Whois Record for a Specific Date
If you need to see the Whois record for a particular date, go to the next date in the timeline above the date you are seeking and click “more.” The timeline will show all of the dates
for which we have records between the previous change and the change at the top (the date on which you clicked “more.”).
For example, suppose you want to find a Whois record from July 4, 2010. If one record in the timeline is 2010-07-06 and the previous date shown is 2010-03-08 (because there were changes
on those dates), clicking “more” on the 2010-07-06 line will expand the display to show all of the (unchanged) records in the database between 3-8 and 7-6. You can then click the Whois
record for July 4 (if one is in the database) or the nearest record before or after that date.
Whois Record Display
The right-hand portion of the screen shows the Whois record for the selected date (the default is the most recent Whois record). When you select a date from the timeline, the Whois record for that date is shown on the right.
“Previous/Next” Navigation
At the top of the Whois record are links that take you to the next or previous changed Whois record for the domain. To explore in strictly chronological fashion, expand the timeline to see all identical
entries between changes and click the record for the desired date.
“Pivoting” via Whois and Reverse Whois
From the Whois record, you can initiate other searches to advance your investigation. The name of the domain, presented as a button, takes you to the main DomainTools Whois page for that domain.
Email addresses shown as buttons launch a Reverse Whois query for that address. This allows you to find other domains, if any, which are connected to the email address. Much of the power of DomainTools
lies in the ability to “pivot” from one piece of information to another, to identify connections among domains, individuals, organizations, IP addresses, and other datapoints.
Download and Permalink controls
Use the Download control to download the displayed record as a .txt file. (If you need to download all the records in a single PDF document, consider Domain Report)
Use the Permalink control if you’d like to send, link, or bookmark the full URL of the page, including the context of the displayed Whois record. For example, if you click on a Whois record from 7-4-2002,
click the permalink control, and then copy the URL in your browser’s address bar, that URL will always take you to the Whois History page with that date’s Whois record shown on the right. Without clicking
the permalink control, the URL in the address bar would take you to the default Whois History page for that domain, which would show the most recent Whois record on the right.
