SecurityTrails Blog · Nov 23 · by Esteban Borges

WHOIS History Update: Get the Full Historical View of a Company's WHOIS records

Reading time: 4 minutes
Listen to this article

Today we're excited to announce several improvements in our WHOIS historical records that take our data to the next level, so you can analyze any domain name ownership information more efficiently.

Research tools offering scanning services, such as Shodan and Censys, are well-known and clearly documented. However, other mass scanners may not be as easy to identify in your firewall and IDS logs. Using SecurityTrails’ new reverse DNS lookup API endpoint, you can research the size and scope of unknown scanners.

The most readily available information when investigating a host is the reverse DNS record (PTR record) associated to its IP address. The value of PTR records is best illustrated in a recent case of ongoing RDP (remote desktop protocol) scans from This example IP address currently has over 700 reports logged on Performing a reverse DNS lookup for this IP address yields the hostname “”

dig -x +short

Simply visiting the third-level domain,, in a web browser reveals the following notice in Chinese and English: