To find when a domain was registered, look up the name in RDAP (the Registration Data Access Protocol, the successor to WHOIS for gTLDs) and read the “registration” event date, which most lookup tools label the creation date. That date answers a narrower question than most buyers think. It tells you when the current registration began, not when the name first existed. A domain registered in 1998, allowed to expire in 2019 and re-registered by a new owner in 2020 shows a 2020 creation date, because the registry treats the re-registration as a new object. The original history is not in the live record.
The true age comes from two other places. WHOIS history services hold archived copies of the registration record going back, in some cases, to the late 1990s, and show every registrant, registrar and nameserver the name has had. Web archives such as the Wayback Machine show what the domain actually served and when. Read together, they reveal whether the creation date you see is the birth of the name or merely its most recent rebirth. That distinction is the first red flag on this list, and nearly every other red flag is found the same way: by comparing what the live record says with what the history shows.
The red flags, how to spot them and what they mean
A creation date that resets after a gap
Pull the WHOIS history and line up the creation dates in each archived record. If an older record shows a creation date years before the current one, the domain dropped and was re-registered. Check the web archive for the gap to see what, if anything, was served during it. A reset is not disqualifying by itself, because good names drop every day; a 2016 measurement found that 10.1% of deleted .com domains are re-registered on the very day they drop, according to Lauinger and colleagues at USENIX Security 2017. It does mean the name has at least two lives, and the earlier one may carry the search penalties, blocklist entries and trademark problems described below. Our guide to buying a re-registered domain covers what a prior life does to value.
Registrar hopping in short succession
The history will show the sponsoring registrar in each record. A name that moves from one registrar to a second and then a third within a few weeks, particularly when the last stop is a registrar outside the original owner’s country, carries the signature of theft. Thieves transfer a stolen name quickly and repeatedly to put distance between the domain and the registrar whose dispute process could reverse the first transfer, and they favor registrars in jurisdictions where a court order is hard to obtain. In the recoveries we handle, this pattern appears in a large share of cases. A seller offering a name with this history must explain each move.
A sudden switch to privacy followed by a sale listing
Compare the registrant fields across records. A domain that showed a company name for a decade, switched to a privacy service, and appeared on a marketplace within days of the switch was either sold legitimately through an escrow service that updates the record, or taken from an account and listed by someone who does not want to be identified. Ask the seller for the escrow transaction or the bill of sale that explains the change. The sequence of privacy then listing is common in stolen domain sales because the thief needs the name converted to cash before the owner notices.
Nameservers that drift to parking, then to a cheap host, then to nothing
The DNS history of a domain shows where it has pointed over time. A name that moved from a corporate DNS provider to a parking service, then to a low-cost shared host, then stopped resolving altogether has been through decline, monetization and abandonment, in that order. The parking period often coincides with the end of the original business. The cheap-host period is where spam or malware activity, if any, occurred. The last stage is usually the lapse that precedes the drop. The sequence tells you which period of the web archive to examine most closely.
Archived content showing pharma, gambling, adult or link-farm use
Open the web archive and step through the captures year by year, paying attention to the periods the DNS history flagged. Pharmaceutical storefronts, casino pages, adult content, and pages of unrelated links with keyword-stuffed anchor text each mean the domain was used to manipulate search results, and that use may have earned a manual action or an algorithmic penalty that follows the name. Such histories are common in the names that drop. When researchers re-registered 201 expired domains, 20.9% had previously hosted real-money gambling and 16.42% were crime-related, as reported by Squarcina and colleagues at IEEE Security and Privacy 2022.
Backlinks from spam networks or a sudden link spike
Run the name through a backlink index and sort the referring domains by first-seen date. A healthy history grows gradually and comes from sites on related topics. A spike of thousands of links in a single month from unrelated sites, from pages in languages the site never used, or from domains that themselves link to pharma and gambling pages, is the fingerprint of a private blog network or a paid link scheme. Whether a prior owner bought the links or a competitor pointed them, the buyer inherits the profile and the disavow work.
Email blocklist history
Check the domain against the major email reputation and blocklist services, and look for historical listings as well as current ones. A domain that was once listed for sending spam may be clean today and still be treated with suspicion by mail providers that keep their own long memory. If the purpose of the purchase is to send email from the name, this check matters more than any other on the list, because deliverability problems inherited from a prior owner can take months to repair.
Safe Browsing or malware history
Google Safe Browsing, VirusTotal and similar services record whether a domain has served malware or phishing. A past listing is a serious flag because the domains that fall into malicious hands after a drop tend to be reused for the same purpose. A study of nine months of pending-delete .com, .net and .org names found that previously malicious domains were caught by dropcatchers about twice as often as benign ones and that 94% of 6,838 subverted domains went on to serve malware, according to Miramirkhani and colleagues at WWW 2018. A name with that history may still be on corporate blocklists that no public service shows.
Trademark collisions
Search the WIPO and Forum decision databases for the domain and for the distinctive word in it. A prior UDRP (Uniform Domain-Name Dispute-Resolution Policy) decision involving the name tells you a trademark owner has already claimed it once, and a decision that transferred the name and a later re-registration is a sign the brand owner let it lapse and may file again. Separately, search the trademark registers in the countries where you will operate. A domain that matches a registered mark in your industry is a name you may be forced to surrender, no matter how clean the rest of the history is.
A seller who cannot show the chain of ownership
Every red flag above can be explained by an honest seller with documents. The seller should be able to show that the registrant in the current record is the seller, that the account the name sits in is theirs, and, for a name acquired recently, the escrow or purchase record from the prior owner. A seller who offers the name through an intermediary, insists on an off-platform payment, or cannot explain why the registrant changed last month is asking you to buy a name whose title may be disputed. Title to a domain follows the chain of control, and a break in that chain is the single strongest signal that the name is stolen. Our post on domain name registration history explains how to document that chain from the archived records.
How DNAccess reports a domain’s history
Our domain name background check pulls the full WHOIS history, the DNS history and the web archive captures for a name, lines them up on one timeline, and reports each of the flags above with the evidence behind it: the records showing a creation-date reset, each registrar transfer with its date, the privacy switch, the nameserver sequence, the archived content in each period, the backlink profile, the blocklist and Safe Browsing history, and any UDRP decisions or trademark registrations that touch the name. We state plainly whether the history is consistent with the seller’s account of ownership, which is the question a buyer most needs answered before money moves. Contact us before you buy, not after.