DNS Has No Memory
When you look up a domain, DNS returns its current records. Once a record changes, the old value is gone from DNS itself. To see where a domain pointed last month or last year, you need a database that recorded the answers over time. This is usually called historical DNS or passive DNS.
Our IP History tool shows the addresses we have observed for a domain, with the dates they were first and last seen.
Where Historical DNS Data Comes From
- Passive DNS sensors: some providers collect DNS answers seen on resolvers, without recording who asked. Over time this builds a large history of domain-to-address mappings.
- Repeated lookups: services that resolve many domains regularly can store each answer. Our database grows from the DNS lookups made with the tools on this site.
- Internet-wide scans and crawls: search engines and research projects also record which addresses served which sites.
No single source is complete. A domain that was rarely looked up may have gaps in its history.
What IP History Is Useful For
Website Migrations
After moving to a new host, history confirms when the switch happened and whether any old addresses still appear. If visitors report the old site, compare the history with what resolvers return now using the DNS Propagation Checker — see also why DNS changes are not showing.
Troubleshooting
If a site suddenly breaks, a recent address change in its history is often the explanation: a new host, a new CDN or a mistaken record edit.
Security Research
Malicious domains often move between servers quickly. Their history can reveal the networks they used and other domains hosted on the same addresses. Combine it with Reverse IP Lookup and ASN Lookup to see who operates those networks.
Checking Your Own Exposure
If your site now sits behind a CDN or proxy, its history may still show the address of your origin server from before the move. Anyone can see that history. If hiding the origin matters to you, move the origin to a new address that has never been published in DNS and restrict it to accept traffic only from the proxy.
How to Read the Results
- First seen / last seen: the period in which the address was observed, not necessarily the exact dates of the change.
- Many addresses at the same time: normal for load-balanced sites and CDNs.
- Frequent changes across unrelated networks: common for cheap hosting moves, but also a pattern seen with abusive domains.
Check which organization owns each address with IP Location; our guide What is an ASN? explains how network ownership works.