{"uid":"cap_pa1tFBWmAo4EYYDao-g_G","slug":"how-is-domain-change-history-561d6ed0","name":"how.is Domain Change History","description":"Check when a domain appeared in the registry zone file, left it, came back or changed nameservers, from daily gTLD and .com/.net zone files. A sudden nameserver move signals a hijack or sale; a brand-new name signals phishing.","url":"https://how.is/v1/domain/changes?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"domain":{"type":"string","maxLength":253,"description":"A registered name directly under a TLD, e.g. example.com (zone files list no subdomains; ccTLDs publish none)"}}},"responseSchema":{"type":"json","example":{"data":{"_shape":"data: in_zone_now, first_seen, first_seen_is_coverage_start, last_seen, current_ns, events[{type: appeared|disappeared|reappeared|ns_changed, dates, from, to, message}], changed_last_30_days, coverage{daily_since, first_zone_file, runs}, ns_runs, note."},"result":"Domain change history for the requested subject","receipt":{"rail":"x402","tool":"changes","charge_usd":0.01,"settlement_tx":"0x…"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_5j3AD9TvnTJhbvhNE_Dlr","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns the full zone-file change history for a domain: when it appeared, disappeared, reappeared, and changed nameservers, from daily gTLD and .com/.net zone file scans.","exampleAgentPrompt":"Check the zone-file change history for suspicious-login-page.com — I want to know when it first appeared, whether it has changed nameservers recently, and whether it looks brand new, which might indicate phishing.","exampleUseCases":[{"title":"Phishing domain triage","prompt":"Pull the zone-file history for secure-paypal-verify.com — I need to know when it first showed up in the registry and whether it's brand new, so I can decide if it's a phishing site."},{"title":"Domain hijack investigation","prompt":"Check if globalcorp.com changed nameservers in the last 30 days — a sudden nameserver move could mean someone hijacked or sold it and I need the full event timeline."},{"title":"Dropped domain reactivation audit","prompt":"Look up the zone history for vintage-threads.com — I want to know if it ever disappeared from the zone file and came back, and what nameservers it's used over time."}],"resultDescription":"Returns a JSON object with: current zone presence (in_zone_now), first and last seen dates, whether first_seen is the start of coverage, current nameservers, a chronological list of events (appeared, disappeared, reappeared, ns_changed) each with dates and before/after nameserver values, a flag for changes in the last 30 days, and coverage metadata showing how far back daily zone file scans go.","failureModes":["Domain is a subdomain or ccTLD — zone files only cover gTLDs and .com/.net, so the response will note no data is available","Domain has never appeared in any scanned zone file — returns empty events and in_zone_now false","Domain string is malformed or exceeds 253 characters — returns a validation error","Payment failure via x402 — call is rejected before processing","Zone file coverage gap — events before daily coverage started may be missing, flagged by first_seen_is_coverage_start"],"whenToPreferThis":"Use this endpoint when you need historical DNS zone-file evidence about a domain's lifecycle — especially to detect phishing (brand-new domain), hijacking (sudden nameserver change), or dropped-and-reregistered domains. Prefer this over WHOIS-age tools when you need event-level granularity (appeared/disappeared/ns_changed), multi-year timelines, or evidence that a nameserver move occurred on a specific date. Not suitable for subdomains or most ccTLDs.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:37:53.436Z","isFirstParty":false,"canonicalSlug":"how-is-domain-change-history-561d6ed0"}