# Domain History Graph

> Registration, DNS, hosting networks, certificates and Wayback captures of a domain as a timeline. Combines public records about a domain: RDAP registration data (registrar, registration/expiry/last-changed dates, status, name servers, DNSSEC), current A/AAAA/NS/MX records and the networks (ASNs) hosting its addresses via RIPEstat, Certificate Transparency history from crt.sh and first/last Wayback Machine captures. Shows a timeline and a relationship graph. Contact names, e-mails and phone numbers are never displayed.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://domainhistorygraph.usefulweb.site/ (interactive tool at https://domainhistorygraph.usefulweb.site/tool)
- JSON API: POST https://domainhistorygraph.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://domainhistorygraph.usefulweb.site/api/v1/tool)
- OpenAPI: https://domainhistorygraph.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://domainhistorygraph.usefulweb.site/mcp - tool `domain_history_graph`

## Inputs
- mode (select): Mode
- domain (text, required): Domain
- certificateTransparency (boolean): Include Certificate Transparency history (crt.sh, slower)
- rdapJson (textarea): RDAP JSON (paste mode)
- cdxRows (textarea): Wayback CDX rows (paste mode, optional) - JSON output (fl=timestamp,statuscode,digest) or plain CDX lines.
- ctJson (textarea): crt.sh JSON (paste mode, optional)

## Method
- RDAP (RFC 9083) via the rdap.org bootstrap redirector, which forwards to the authoritative registry/registrar RDAP server. Only registrar, dates, status, name servers, DNSSEC and — if published — the registrant organisation and country are shown; contact names, e-mails, phone numbers and street addresses are dropped and only counted.
- Current DNS (A, AAAA, NS, MX) from this server's resolver; hosting network per public address via RIPEstat network-info (origin ASN + prefix) and as-overview (holder name).
- Certificate Transparency: crt.sh JSON for the exact domain, deduplicated by serial: first certificate seen, latest issuance, issuing organisations, distinct names.
- Wayback Machine CDX API: the 10 oldest and 10 newest captures (fl=timestamp,statuscode,digest); digest changes between samples indicate content changes. Totals across all captures are not computed (the index is too large to count cheaply).
- Paste mode uses the RDAP "last update of RDAP database" event as the reference time for age/expiry so results do not depend on when you run it.