Domain History Contact OSINT - Previous Owner + WHOIS History

Domain history and previous owner lookup for dead, expired and parked domains. WHOIS history, Wayback Machine pages, and the owner's emails, phones, people and organisations, each with a source URL and capture date.

Available as an Apify Actor. $0.25 per domain scan + $0.02 per contact found. One input field, no API key needed.

What does it do?

You type a domain and press Start. You get who owned it and how to reach them, even when the website is gone, as a table where every row carries the URL and capture date it came from. It reads 14 public sources, works on domains that no longer resolve, and always finishes with a report that says which sources answered and which did not.

• Contacts with provenance. Emails, phones, people and organisations. One dataset row per contact per source, each with sourceUrl, snapshotTimestamp, replayUrl and extractionMethod. One row is one claim you can cite.
• People and organisations, with roles. A multilingual named-entity model reads the rendered archived pages. Each person carries a role when the page stated one ("Founder", "Geschäftsführer"), a worksFor when a company sat next to the name, a relation flag (site = part of the site itself, mention = named in its content) and the visible snippet the name was read from.
• Registration. RDAP registrant and organisation where not redacted, registrar, the registrar abuse contact, creation and expiry events, nameservers. WHOIS history back to 2008 with a free SecurityTrails key, or from 2012 with a Whoxy key: pre-GDPR registrant names, emails and phones.
• DNS now and then. Current A, AAAA, MX, NS, TXT and SOA, historical nameservers and historical IPs from passive DNS, each IP geolocated to country, city, ISP and AS number. SaaS verification tokens in TXT are flagged because they tie a domain to named vendors.
• Certificate history. Every hostname that ever appeared in a certificate for the domain. Certificates outlive domains.
• Past versions of the website. Archived pages sampled across the domain's whole lifetime and weighted toward contact, about, team, imprint, careers, management and board pages.
• Server software. The dead origin's own response headers, recovered from the archive. From a domain offline for years: Apache/1.3.36 (Unix) ... PHP/4.4.2 FrontPage/5.0.2.2635 mod_ssl/2.8.27 OpenSSL/0.9.7a.
• Tracking IDs. Google Analytics, GTM, AdSense, Google Ads, Segment, Optimizely, Hotjar, Mixpanel and Meta pixel IDs from the archived bytes. Reverse-look these up to find every other domain the same owner ran.
• Inbound references. Who else mentioned this domain: urlscan.io submissions, Arquivo.pt full-text archive hits, Common Crawl, and public source code on grep.app. Config files and mail settings name real addresses.
• A per-source coverage report. Which sources answered, which held nothing, and which throttled you. Throttled is reported as unknown, not as empty.

How is it different from a contact scraper or a WHOIS history service?

Three measurements behind that table. On one dropped domain the archived contact page held 0 addresses, while certificate transparency returned 2,644 certificates and public code search returned 3 genuine addresses: the extra sources are where dead domains still answer. The largest contact scraper on the Store (58,952 users) returns a flat array of pages next to a flat array of emails with no mapping between them, which looks like provenance and is not. And since GDPR in 2018, the registrant on current WHOIS is redacted for most domains, so a named owner comes from archived pages, certificates and WHOIS history, not from today's record.

Two open-source tools deserve a mention. WayTrace and kronikier both mine web archives for historical contacts and both are MIT. If archives are all you need, use them. This actor exists for the case where the archive is thin and you still need an answer, which is the normal case on a fully dropped domain.

When should I use it?

• You need to find out who owned a domain in the past, or who ran a website that is now offline.
• A counterparty, supplier or "company" you are checking has a website that has vanished, been scrubbed or been parked, and you need the people behind it.
• You are investigating fraud, a scam or financial crime and every finding must carry a source URL and date you can put in a report.
• You are buying an expired domain and want to know what it used to be, who ran it, and which analytics IDs tie it to other sites.
• You are a journalist or in legal discovery and need the Wayback Machine mined for emails and phone numbers with the capture date on each hit.
• You want to contact the previous owner of a domain, for a purchase, a takedown, or a transfer.

What does it cost?

Pay-per-event. You pay for the scan and for what it finds; platform compute is included.

The summary row is free.

Typical scan costs

Row counts measured on the platform at Standard depth (Quick, the default, finds most of the same contacts from fewer pages); prices at the default 2 GB:

• Small dead site (youthgrowyouth.in): 6 contacts + 36 mentions, $0.44
• Sparse result (yikyakapp.com): 3 contacts, no mentions, $0.31
• Large corporate archive (theranos.com, 231 rows): 47 contacts + 183 mentions, $1.56
• Nothing recoverable: $0.25, the scan plus the free summary row that says why

A Quick run takes about 3 minutes at 2 GB and Standard about 6; raising memory to 4 GB roughly halves the time and doubles the scan fee. Deep depends on how much the archive holds. Set a spending limit on the run for a hard cap; the summary row says so if it was reached.

Which inputs does it take?

What does the output look like?

Each dataset record is one contact from one source. A person row from a real run, with the sightings array cut to one entry:

{
  "domain": "youthgrowyouth.in",
  "type": "person",
  "value": "Anshuman Atrey",
  "role": null,
  "worksFor": "Youth Grow Youth",
  "relation": "site",
  "pagesSeenOn": 14,
  "confidence": "high",
  "sourceType": "wayback",
  "sourceUrl": "https://youthgrowyouth.in/businesses/",
  "snapshotTimestamp": "20230605184117",
  "replayUrl": "https://web.archive.org/web/20230605184117id_/https://youthgrowyouth.in/businesses/",
  "extractionMethod": "ner",
  "occurrences": 40,
  "firstSeen": "20230605184117",
  "lastSeen": "20240328173211",
  "snippet": "Copyright © 2023 Youth Grow Youth | Created with ❤ by Anshuman Atrey",
  "sightings": [
    {
      "sourceType": "wayback",
      "sourceUrl": "https://youthgrowyouth.in/businesses/",
      "snapshotTimestamp": "20230605184117",
      "replayUrl": "https://web.archive.org/web/20230605184117id_/https://youthgrowyouth.in/businesses/",
      "extractionMethod": "ner",
      "pageId": 1,
      "context": { "role": null, "worksFor": "Youth Grow Youth", "snippet": "Copyright © 2023 Youth Grow Youth | Created with ❤ by Anshuman Atrey" }
    }
  ]
}

An email row. This address was hidden behind Cloudflare's email obfuscation on the page and decoded:

{
  "domain": "youthgrowyouth.in",
  "type": "email",
  "value": "mail@youthgrowyouth.in",
  "confidence": "medium",
  "sourceType": "wayback",
  "sourceUrl": "https://youthgrowyouth.in/businesses/",
  "snapshotTimestamp": "20230605184117",
  "replayUrl": "https://web.archive.org/web/20230605184117id_/https://youthgrowyouth.in/businesses/",
  "extractionMethod": "cloudflare-xor",
  "occurrences": 54,
  "firstSeen": "20230605184117",
  "lastSeen": "20240328173211"
}