How to Monitor Website Hosting Changes With dig, cron and an API

To monitor website hosting changes, take a snapshot of a domain's DNS records and providers on a schedule and compare each snapshot with the last one. This guide builds that monitor with dig, curl, cron and diff. An optional step adds provider names, such as the hosting provider and content delivery network (CDN), from the Hosting Checker API.

Quick Answer: To monitor website hosting changes, save a domain's A, AAAA, NS and MX records and the IP's network owner to a file, run that script daily with cron, and diff each run against the previous one. Any line in the diff is a change. To also track the hosting provider, CDN and DNS provider by name, call the Hosting Checker API from the same script.

Hosting Checker does not watch domains for you: it has no alerts or scheduled checks. Each lookup shows the state of a domain at that moment. The script in this guide does the watching.

Why track hosting changes?

Competitive intelligence

When a competitor moves from shared hosting to AWS, or puts its site behind Cloudflare, it has spent money on its infrastructure. A record of these moves shows what a competitor changed and when.

Security monitoring

An unexpected DNS change can mean someone took over a domain and pointed its traffic at their own servers. If you watch your own domains, you see a changed nameserver or A record the next time the script runs.

Due diligence

When you evaluate a company or a website to buy, its hosting setup affects the price and the work after the deal. A record of changes during the review period shows whether the setup matches what the seller described.

Client and portfolio management

Agencies and holding companies that manage many websites need to know when a domain's hosting changes. The change may be a planned migration or an expired account.

What changes to monitor

A hosting migration usually changes one or more of these:

For background on these record types, see our guide to DNS records.

Step 1: Take a snapshot by hand

Start with one manual check, so you know what normal looks like.

Using Hosting Checker

Enter the domain in our hosting check. It shows the hosting provider, CDN, DNS provider, email provider and registrar, with the IP address, DNS records and SSL certificate.

For one part at a time, use our DNS lookup tool for records and our IP lookup tool for the network that owns an address. To see how the hosting check identifies providers, read how to find out who hosts a website.

Using command line tools

These commands ran on 2026-10-12 against discord.com:

dig discord.com A +short

162.159.128.233
162.159.135.232
162.159.136.232
162.159.137.232
162.159.138.232

dig discord.com NS +short

gabe.ns.cloudflare.com.
sima.ns.cloudflare.com.

curl -s https://ipinfo.io/162.159.128.233/json

{
  "ip": "162.159.128.233",
  "city": "San Francisco",
  "region": "California",
  "country": "US",
  "org": "AS13335 Cloudflare, Inc.",
  "anycast": true
}

The output is trimmed. ipinfo.io answers a small number of requests without a token. For regular use, create a free ipinfo account and add ?token=YOUR_TOKEN to the URL.

For more DNS commands, see how to find DNS records for any domain.

Step 2: Write a snapshot script

The script below saves one snapshot file per domain. On each run it moves the last snapshot aside, writes a new one and prints a diff if anything changed. It sorts every record list, because DNS servers return records in a different order on each query.

#!/usr/bin/env bash
# hosting-snapshot.sh: records the hosting state of each domain
# and prints what changed since the last run.
set -uo pipefail
 
DOMAINS=(discord.com canva.com)
DIR="${SNAPSHOT_DIR:-$HOME/hosting-snapshots}"
mkdir -p "$DIR"
 
records() {
  dig +short "$1" "$2" | sort | paste -sd ' ' -
}
 
for domain in "${DOMAINS[@]}"; do
  current="$DIR/$domain.txt"
  previous="$DIR/$domain.prev.txt"
  [ -f "$current" ] && mv "$current" "$previous"
 
  ip=$(dig +short "$domain" A | grep -E '^[0-9.]+$' | sort | head -1)
 
  {
    echo "A:       $(records "$domain" A)"
    echo "AAAA:    $(records "$domain" AAAA)"
    echo "NS:      $(records "$domain" NS)"
    echo "MX:      $(records "$domain" MX)"
    echo "www:     $(records "www.$domain" CNAME)"
    echo "network: $(curl -s "https://ipinfo.io/$ip/org")"
  } > "$current"
 
  if [ -f "$previous" ] && ! diff -u "$previous" "$current" > "$DIR/$domain.diff"; then
    echo "$domain changed:"
    cat "$DIR/$domain.diff"
  fi
done

The first run writes the snapshots and prints nothing. This is the canva.com snapshot from 2026-10-12 (AAAA and MX lines shortened):

A:       3.174.230.24 3.174.230.34 3.174.230.36 3.174.230.52
AAAA:    2600:9000:290c:3400:b:add6:7500:93a1 ...
NS:      ns-1421.awsdns-49.org. ns-1851.awsdns-39.co.uk. ns-253.awsdns-31.com. ns-730.awsdns-27.net.
MX:      1 aspmx.l.google.com. ...
www:     www.canva.com.cdn.cloudflare.net.
network: AS16509 Amazon.com, Inc.

To test the alert, edit the NS: line in discord.com.txt and run the script again. It prints the change as a diff (header lines trimmed):

discord.com changed:
@@ -1,6 +1,6 @@
 A:       162.159.128.233 162.159.135.232 162.159.136.232 162.159.137.232 162.159.138.232
 AAAA:
-NS:      ns1.oldhost.example.
+NS:      gabe.ns.cloudflare.com. sima.ns.cloudflare.com.

The script only prints when something changed, so silence means no change.

Step 3: Run it on a schedule with cron

Run crontab -e and add a line. This one runs the script every day at 06:00:

MAILTO=you@example.com
0 6 * * * /home/you/bin/hosting-snapshot.sh

Most cron implementations email any output to the MAILTO address, if the machine can send mail. Because the script is silent when nothing changed, you only get an email when a domain changed. If your machine cannot send mail, append >> /home/you/hosting-snapshots/changes.log 2>&1 to the line and read the log instead.

DNS answers are cached for the record's TTL, so a change can take up to that long to show up. A daily run is enough for competitors and clients. For your own domains, run it hourly (0 * * * *).

Step 4: Add provider names with the Hosting Checker API

The snapshot above tells you that an IP or nameserver changed. It does not name the new hosting provider, CDN or platform. The Hosting Checker API returns those names as JSON, so you can add them to the snapshot.

API lookup example

Create an API key in the dashboard, then call the /check endpoint:

curl -s -H "Authorization: Bearer YOUR_API_KEY" \
  "https://hostingchecker.online/api/v1/check?query=discord.com"

Every response has the same four fields: query, checkedAt (when the lookup ran), cached (true when it came from the cache) and data. For /check, data includes:

• dnsRecords: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and SRV records
• ipInfo: IP geolocation and network (org, asn, city, country)
• sslInfo: the SSL certificate's issuer, validity and status
• rdap: registration data, such as registrar and expiry date
• provider: the detected hostingProvider, cdn, platform, dnsProvider, emailProvider and registrar, each with a name, plus the evidence behind them

The full response schema is in the API reference. The API also has /dns, /ssl, /ip, /whois, /email-auth, /mx and /nameservers endpoints for single lookups.

To pick out the provider names, pipe the response through jq:

curl -s -H "Authorization: Bearer YOUR_API_KEY" \
  "https://hostingchecker.online/api/v1/check?query=discord.com" \
  | jq -c '.data.provider | {network: .hostingProvider.name, cdn: .cdn.name,
      platform: .platform.name, dns: .dnsProvider.name,
      email: .emailProvider.name, registrar: .registrar.name}'

For discord.com on 2026-10-12, this matched what the hosting check showed:

{"network":"Cloudflare","cdn":"Cloudflare","platform":null,"dns":"Cloudflare","email":"Google Workspace","registrar":"Cloudflare, Inc."}

Add the API call to the script

Export your key as HC_API_KEY and add these lines inside the { ... } block of the script, after the network: line:

    if [ -n "${HC_API_KEY:-}" ]; then
      echo "providers: $(curl -sf -H "Authorization: Bearer $HC_API_KEY" \
        "https://hostingchecker.online/api/v1/check?query=$domain" \
        | jq -c '.data.provider | {network: .hostingProvider.name, cdn: .cdn.name,
            platform: .platform.name, dns: .dnsProvider.name,
            email: .emailProvider.name, registrar: .registrar.name}' \
        || echo "lookup failed")"
    fi

If the API call fails, the line says lookup failed. That line then shows up in the diff, so a failed lookup is never silent.

API quota

Each API lookup that is not served from the cache counts against your monthly quota. Results stay cached for up to an hour, and a cached answer does not count. The Free plan includes 100 lookups per month. Basic ($9 per month) includes 5,000, Growth ($29) 25,000 and Scale ($79) 100,000. When you reach the limit, the API answers with HTTP 403 until the next period.

For a script that makes one lookup per domain per run:

• Daily checks of 3 domains: about 93 lookups per month, which fits the Free plan.
• Hourly checks of 1 domain: about 744 lookups per month, which needs Basic.

Every API lookup also appears in your lookup history, so you can look back at past results there. The history lists lookups but does not compare them. The diff in your script does the comparing.

Interpreting hosting changes

The kind of change tells you what probably happened:

False positives to watch for

Not every IP change means a hosting migration:

• CDN address rotation. CDNs such as CloudFront and Akamai can return different IP addresses from one query to the next. The provider has not changed.
• Cloud instance replacement. A server on AWS, Google Cloud or Azure can get a new public IP when the instance is replaced.
• Load balancer changes. A provider can move a site to new load balancer addresses.

If a domain's IPs change on most runs, remove the A: and AAAA: lines from its snapshot and keep the network: and providers: lines. A new network owner or a new provider name is a clearer sign of a migration than a new IP.

Frequently Asked Questions

How often should I check for hosting changes?

Once a day is enough for competitors and clients, because migrations are planned events. For your own domains, check every hour. Hourly checks use about 744 API lookups per domain per month (see API quota).

Can I detect hosting changes in real time?

Not with a script on a schedule. You can shorten the delay by asking the domain's authoritative nameserver directly, which skips cached answers: dig @gabe.ns.cloudflare.com discord.com A +short. For your own domains, check whether your DNS provider keeps an audit log of record changes.

What's the difference between a CDN change and a hosting change?

A hosting change means the origin server, where the application runs and the data lives, moved to a different provider. A CDN change means the network that serves cached content to visitors changed, while the origin may have stayed. The Hosting Checker API reports them separately: provider.cdn for the CDN and provider.hostingProvider for the network that owns the IP. When a CDN sits in front of the site, the IP belongs to the CDN, so the origin host stays hidden. Our IP lookup tool shows who owns any address you find.

How do I monitor hosting changes for free?

Use the script from Step 2 with dig, curl and cron. It is free and tracks IP, DNS and network changes. To add provider names, the Hosting Checker API's Free plan includes 100 lookups per month, enough for daily checks of 3 domains. To check a site by hand, find your website's IP address and run it through our hosting check.

Wrapping up

To monitor website hosting changes, save a snapshot of each domain on a schedule and diff it against the last one. dig and curl cover IP, DNS and network changes for free. The Hosting Checker API adds the hosting provider, CDN and DNS provider by name. For a one-off check, our hosting check shows all of it in one lookup.

Related articles

• Where Is This Website Hosted? How to Find Out
• How to Check DNS Records for Any Domain
• Website IP Lookup: How to Find Your Website's IP Address
• DNS Records Explained