Audit a domain before you buy it

Most indie devs pick a domain by vibe: it's short, it sounds good, the .com is available, done. That's the same energy as buying a used car without popping the hood.

Domains carry history, and algorithms remember it. If the domain you just registered spent 2019-2023 redirecting to a Romanian gambling site, you're not starting from zero — you're starting from negative. And you won't find out until you've shipped three months of content and you're still pagespeed-99, schema-perfect, and invisible.

This lesson is the six-check audit to run before you put a card in the registrar checkout, plus a decision matrix for when something flags.

Why inherited reputation is real

Google's link graph doesn't reset when a domain changes hands. A dropped domain that accumulated tens of thousands of spammy referring domains from a 2018 PBN keeps those links until they slowly decay (or until someone disavows them). Same for AI search citations — a domain that was harvested for low-quality content years ago can still surface in stale crawls and weight against you.

Three patterns we see repeatedly in indie migration cases:

• Previous PBN ownership correlates with measurably slower ranking velocity for the first 12-18 months versus a comparable freshly registered domain
• Historical adult, gambling, or pharma content suppresses crawl budget — Googlebot visits less often and indexes new pages more slowly even after the content is gone
• Prior counterfeit-brand violations can trigger automatic manual-action holds for any trademark-adjacent content you write later

You can recover from all of these, but the recovery cost in time and effort is almost always higher than just picking a different domain.

The six checks (each one takes 2-5 minutes)

1. Spammy backlinks

The fastest way to read a domain's link reputation is the Trust Flow / Citation Flow ratio in Majestic. The free site-explorer tab handles one-off lookups. A clean domain has TF and CF roughly proportional. A spam-bombed domain has high Citation Flow (lots of links pointing at it) and low Trust Flow (none of those links are from trusted sites).

Manual check:

• Paste the domain into majestic.com or ahrefs.com/site-explorer
• Look at the ratio. TF/CF below 0.3 = warning. Below 0.15 = walk away.
• Scan the top 20 referring domains. If you don't recognize any of them as legitimate sites, dig in further.

2. Gambling, adult, or pharma history

Open web.archive.org/web/[the-domain] and click through 5-10 snapshots spread across different years. You are looking for:

• Casino, sportsbook, or poker pages
• Adult content (NSFW imagery in the snapshot thumbnails)
• Pharmacy spam — Viagra, Cialis, Tramadol keyword stuffing
• Foreign-language gambling or adult content, often in Russian, Chinese, or Indonesian

Why these specifically: Google has historical category-level signals on these niches that persist on the domain after content removal. Your new "indie SaaS for devs" site inherits the moderation flag for years.

3. Counterfeit or fake-brand history

Wayback Machine search for the domain combined with the words "buy", "discount", "outlet", or "official". Look for:

• Pages selling Nike, Louis Vuitton, Rolex, or Apple-branded products at suspiciously low prices
• "Official" sites for brands the domain has no plausible relationship to
• Cyrillic or CJK product listings — a common counterfeit-storefront indicator

If you find any of this, the domain has likely had DMCA complaints filed against it. Those persist in registrar and platform records and follow the domain regardless of new ownership.

4. AI spam / content-farm history

This is the 2025-2026 specific check, and the one nobody else's checklist covers. Look at Wayback snapshots from 2022 onward for:

• Massive content output, 100+ articles per month, on unrelated topics
• Telltale AI-generation tells in headlines: "delve into", "in today's digital landscape", "tapestry of", "navigate the complexities of"
• Generic affiliate roundup posts ("10 best X for Y") across dozens of unrelated niches with no editorial focus
• Identical templated H1/H2 structure across hundreds of pages

Google's March 2024 core update and the follow-up Helpful Content updates explicitly target these patterns. The HCU demotion signal can persist on the domain even after the content is fully removed. This is the failure mode that bit a lot of indie devs in 2024-2025 who bought "aged" domains without checking what made them old.

5. PBN (private blog network) footprint

PBNs are clusters of expired domains repurposed to link to a single "money" site. Telltale signs in Wayback:

• A short-lived (6-18 month) blog with thin, generic content
• Outbound links to unrelated commercial sites in adjacent industries
• The same WordPress theme used across visibly different "brands" the same owner controls
• No author bylines, no contact page, no real business behind the writing

Cross-check the IP history at viewdns.info/iphistory. If the domain shared an IP with dozens of other thin-content domains, it was almost certainly part of a network — and Google's spam team has gotten very good at unrolling those networks retroactively.

6. Redirect-only history

Some expired domains were never built out. They were registered solely to 301-redirect link equity to someone else's money site. In Wayback that looks like a domain with snapshots showing a "site moved to..." page, or no snapshots at all despite the domain having been registered for years.

This is the least bad of the six — redirect-only history doesn't accumulate content penalties — but it tells you the domain was previously owned by someone doing SEO manipulation. If you can verify their target site got hit, you don't want the leftovers.

What to do when something flags

Finding	Action
Spammy backlinks only	Negotiable — submit a disavow file day one, budget 6-12 months recovery
Gambling, adult, or pharma history	Walk away — category-level signals are hard to lift
Counterfeit-brand history	Walk away — DMCA and manual-action risk too high
AI content-farm history	Walk away — HCU demotion is a black-box signal that can't be appealed
PBN footprint	Walk away — manual-action risk plus reputation transfer
Redirect-only history	Usually fine — verify no other flags present

When in doubt: there are over 350 million registered .com domains. Pick a different one.

The pre-purchase checklist

Copy this into your notes app. Run it before every domain you are seriously considering.

• Wayback Machine: 10+ snapshots reviewed across the domain's lifetime
• No gambling, adult, or pharma content in any snapshot
• No counterfeit-brand product pages in any snapshot
• No AI-content-farm patterns from 2022 onward (volume, AI tells, templated structure)
• Majestic / Ahrefs: Trust Flow ÷ Citation Flow ≥ 0.3
• Top 20 referring domains all look legitimate when spot-checked
• viewdns.info/iphistory: no shared-IP cluster with thin-content neighbours
• WHOIS history: ≤ 3 prior owners (more = higher chance of abuse cycle)
• No suspicious archive.org traffic-pattern drops that suggest a manual action
• If anything flagged: documented decision to proceed or walk

A clean domain doesn't make your SEO. A dirty one breaks it before you start.

Tools — free first

If you are checking one domain, manual is fine and free. The toolkit:

• web.archive.org — your primary source. Free. Infinite history.
• majestic.com — free site explorer for the TF/CF ratio
• ahrefs.com/site-explorer — free tier shows the top backlinks
• viewdns.info/iphistory — free IP history lookup
• whois.domaintools.com — WHOIS ownership history, free for one or two lookups per day
• SpamZilla / CatchDoms / Karma.Domains — paid; only worth it if you are evaluating 10+ domains per week (expired-domain investors, not first-time indie founders)

You do not need any paid tool to do this audit. You need 30 minutes and the willingness to walk away from a name you have already started imagining your logo on.

→ Next: Module 2 — schema strategy (coming soon)