Historical WHOIS Records
Read a Domain’s Registration Trail Record by Record.
One call to WHOIS History returns the historical WHOIS records of a domain: each distinct registration record Deepinfo has observed for it, each with the dates it was seen. For the history of many domains at once, talk to our data team.
WHOIS history
acme.example
/analyze/whois-history
records
- check_datesMar 2 2024
- check_datesMar 10 2025
- check_datesSep 22 2026
What changed between the last two records
name_serversnew operator- ns1/ns2.hosting.example (before), now ns1/ns2.acme.example
expiry_daterenewed- 2026-03-14 (before), now 2027-03-14
Each Distinct Record Comes With Its Dates.
Each entry in the response is one distinct registration record: registrar, creation, update and expiry dates, registrant where published, name servers and status codes. check_ lists every time Deepinfo saw that exact record.
Read the entries in order and you have the domain’s trail: when it changed registrar, when its name servers moved, when it was renewed.
Request
curl "https://api.deepinfo.com/v1/analyze/whois-history?domain=deepinfo.com" \
-H "apikey: YOUR_API_KEY"Response
[
{
"whois": {
"create_date": "2001-06-05T02:57:08Z",
"update_date": "2025-08-19T07:33:45Z",
"expiry_date": "2028-10-20T11:59:59Z",
"registrar": "godaddy online services cayman islands ltd.",
"registrant": { "…": "…" },
"name_servers": [
"may.ns.cloudflare.com",
"simon.ns.cloudflare.com"
],
"domain_status": [
"clientdeleteprohibited",
"clienttransferprohibited"
],
"whois_server": "whois.uniregistrar.com",
"check_date": "2026-09-01T08:00:00Z"
},
"check_dates": [
"2026-09-01T08:00:00Z",
"2026-08-01T08:00:00Z"
]
}
]Pick the Route by the Question.
| Domain WHOIS | What is this domain’s record now? / |
|---|---|
| WHOIS History | What has it been before? / |
| Reverse WHOIS Email | Which domains share this registrant email? / |
| Daily Updated Domains | Which registrations changed in the last day? / |
| Deepinfo Platform | Did one of our monitored domains change? The asset_ notification and each asset’s WHOIS snapshots answer it. |
| Data team | What have many domains been before? No public endpoint. Talk to our data team. |
Work That Spans Many Registration Trails.
Due Diligence
Check a target’s domain portfolio against its registration history, not only against the list in the data room.
Threat Hunting
Cluster infrastructure by registrar, name servers and registration dates across many domains at once.
Incident Investigation
Line up how each domain in a case was registered and changed over the months before the incident.
Domain Research
Study renewals, transfers and registrar moves across a set of domains, offline and at your own pace.
See This Data at Work in the Deepinfo Platform
This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs.
Questions About Historical WHOIS Records
Is there a bulk WHOIS history endpoint?
No. The public API returns WHOIS history one domain per call, through WHOIS History. For many domains at once, talk to our data team.
How far back does the history go?
It depends on the domain. WHOIS History returns each distinct record Deepinfo has observed for it, with the dates it was seen, so the oldest check_ entry is the earliest observation we hold.
Are registrant details included?
Where the registry published them at the time. The parsed record carries a registrant block, and many registries redact or proxy those fields.
Can we find domains that once listed a registrant email?
Yes, with Domain Search on domain.whois_, which keeps each registrant email seen in a domain’s WHOIS records over time.
Can analysts read WHOIS history without writing code?
Yes. Instant Lookups shows WHOIS History for a domain in the Deepinfo Platform, next to the current WHOIS record.
Take a Bulk WHOIS Question to Our Data Team.
Tell us which domains, which period and how your team loads data. We tell you what can be provided, and in what form.