What is IP history?

A and AAAA records

A domain's A records give its IPv4 addresses, such as 192.0.2.10, and its AAAA records give its IPv6 addresses, such as 2001:db8::10. Browsers use them to connect to the site. The history lists the values of these records recorded over time.

Which records a search returns

A search asks Profundis for the domain's A and AAAA records and returns the 50 most recent, records without a date last. When all 50 are dated, the page then loads older dated records, 50 at a time, up to 300 records. Profundis collects DNS data from public sources: a new domain, or one it has not collected yet, can have few or no records. Records of subdomains such as www.example.com are not included; you can search a subdomain separately.

When more records exist, the page shows the total reported by Profundis. The rest, with filters and exports, is on Profundis.

For a domain listed in Browse, the page shows a stored copy of the records. Every result page gives the date its records were retrieved.

How a result page groups the records

Records are grouped by address, and the addresses by the provider range or CDN network they match or, without a match, by network. A chart places the recorded dates of each group on one time axis, and each group has its own table; groups of CDN addresses start closed. For each address the page shows:

• the network name, ASN and CIDR block announcing it when the data was retrieved;
• the dates of its records, described below, and their number when there are several;
• an approximate location, also described below.

The summary counts distinct addresses, networks (ASNs) and countries across the results. The first address returned is the most recent in these results. It may no longer be published, and a domain with several addresses publishes others alongside it.

The list of networks shows up to eight names, ordered by the earliest date among the addresses each one announces. Several networks may have been used at the same time, for example with two CDNs, and the order does not describe a migration.

Each address links to a Profundis search for the domains recorded on it. An address with a published page on reverseips.com also links to that page, which lists other hosts recorded on the address. Sharing an address does not show that two domains have the same owner.

Three records grouped into two addresses

This illustration uses invented dates and addresses reserved for documentation (IPv4 and IPv6). It is not a lookup for a real domain.

The page shows two addresses. The IPv4 entry contains two records, with 2025-01-03 as its earliest date and 2025-02-12 as its latest. The IPv6 entry contains one record dated 2025-03-08.

Dates shown for each address

Each record comes with a date supplied by Profundis, usually when its value was first recorded. An address shows the earliest and latest of these dates. Neither is the date the domain stopped using it; see Reading a DNS timeline on dnstimeline.com.

Approximate location of an address

Locations come from the GeoLite2 City database by MaxMind, included with this site. They show where the address is located today according to that database, not where it was when the record was collected. MaxMind states that IP geolocation is inherently imprecise (MaxMind documentation). For CDN addresses, see IP history of a site behind a CDN.

Checking the current address

For the addresses published today, query a public resolver, for example dig @1.1.1.1 example.com A and dig @1.1.1.1 example.com AAAA.

For a domain listed in Browse, this site asks 1.1.1.1 once a day, and the result page shows the answer with its date as long as it is less than 48 hours old. Recorded addresses found in that answer are marked.

To compare an address change with a platform's published addresses, use the hosting history examples.