Checking Your Own Public Footprint Part 1: Why Registrars, Defaults, and Time All Drift

Domain registration data, DNS records, and account metadata all drift. Not because anyone did anything wrong, but because none of it is static. Registrars change hands, get acquired, or get migrated away from. Privacy options that were opt-in when you first registered a domain become opt-out later, or vice versa. A username you picked in 2015 for a forum you’ve forgotten about is still sitting there, still linked to whatever email address you used at the time. None of this requires an incident to matter. It just requires time.

This series is a practical audit, not a case study. Every technique in it is something you run against your own domains, your own usernames, and your own repositories, using tools that are free, well documented, and in several cases already sitting on a Kali install. Nothing here demonstrates a finding against a real target. Where a live command is genuinely useful to show, it runs against a fabricated identity built for that post alone, or against a piece of infrastructure that’s already meant to be public, like a domain registry’s own record of itself.

What actually drifts

A few concrete ways your public footprint changes without you touching anything:

Registrar transfers. Moving a domain between registrars is routine, sometimes forced by a registrar being acquired or shutting down a product line. Privacy settings do not always carry over cleanly. A domain that had WHOIS privacy enabled at the old registrar can land at the new one with privacy off by default, sometimes for weeks before anyone notices, sometimes indefinitely if nobody checks.

Protocol transitions. The domain industry is mid-migration from WHOIS to RDAP, a newer, structured, JSON-based replacement. Generic top-level domains largely finished this transition in January 2025. The .uk namespace, run by Nominet, is on its own later timeline: WHOIS for .uk stops entirely on 9 February 2027. Anyone relying on old documentation, an old script, or an old habit of running whois against a .uk domain is going to hit a wall on that date, and the record format on the other side of RDAP looks nothing like the WHOIS output most people are used to reading.

Certificate issuance. Every TLS certificate issued for a domain, by any certificate authority, gets logged permanently and publicly under Certificate Transparency (RFC 6962). This has nothing to do with privacy settings. It happens automatically, it cannot be opted out of, and it means every subdomain that has ever had a certificate issued for it is queryable forever, whether or not you remember it exists.

Account accumulation. Every service you’ve ever signed up for with a given email or username is still, in some form, a public data point tying that identifier to that service, unless the account was deleted and the service actually purges deleted-account data rather than just hiding it. Most people have signed up for far more services than they remember.

Archival. The Wayback Machine has been quietly snapshotting public pages, including WHOIS lookup services, since the late 1990s. A stale registration record from a registrar you left a decade ago, showing your name and old address, does not disappear when you switch privacy on today. It’s already archived.

The shape of this series

Seven parts, in order:

1. This one.
2. Reading your own WHOIS and RDAP records, understanding what .uk privacy actually does and doesn’t hide, and pulling your own certificate transparency history from crt.sh.
3. What a username reveals across other services, using Maigret against a purpose-built decoy identity, and what “210 sites checked, 1 match” actually means before you trust it.
4. Code and infrastructure exposure: scanning your own public repositories for leaked secrets, checking what’s publicly indexed about your own IP space, and what’s hiding in a file’s metadata.
5. Historical exposure: the Wayback Machine trick for finding pre-privacy WHOIS snapshots, basic search-engine dorking, and a genuinely safe way to check whether your passwords have shown up in a breach.
6. What to actually do about anything the previous five parts turned up.
7. Running the whole thing through SpiderFoot, an open-source aggregator that automates most of parts 2 through 5 in one pass, and what it still won’t catch for you.

I ran this exact audit against my own domain not long ago, off the back of a registrar transfer, and it was a useful reminder that “I set this up correctly once” and “this is still correct” are different claims. Nothing from that run appears in this series directly. Every example from here on is either fabricated for demonstration or run against infrastructure that’s already meant to be public.

Part 2 starts with the tool most people have half-forgotten how to read: whois itself, and its replacement.