Checking Your Own Public Footprint Part 5: The Wayback Machine, Dorking, and a Safe Way to Check Breaches

16 August 2026 Security OSINT Privacy Wayback Machine

Every fix in Parts 2 through 4 only changes what’s true from today forward. None of it touches what was already true, and already public, before you made the fix. This part is about finding that.

The Wayback Machine trick

The Internet Archive’s Wayback Machine has been snapshotting public pages since the late 1990s, including third-party WHOIS lookup tools, not just the domains themselves. A domain that had no privacy protection for its first few years, then had privacy switched on later, can still have an old, fully exposed WHOIS snapshot sitting in the archive from before the switch. Turning privacy on today does not retroactively remove it.

The CDX API is the fastest way to check, returning a plain list of every capture the Archive holds for a URL pattern:

$ curl -s "http://web.archive.org/cdx/search/cdx?url=who.is/whois/yourdomain.co.uk*&output=json"

Run generically against a domain that’s already meant to be public, Nominet’s own, this returns real, live results:

[["urlkey","timestamp","original","mimetype","statuscode","digest","length"],
["is,who)/whois/nominet.uk","20090915223714","http://who.is:80/whois/nominet.uk","text/html","200","KKWPUUYCLEI2UJYM7LVXOJMCPLJGEQIJ","4957"]]

That’s a real snapshot of a WHOIS lookup page, archived in 2009, still retrievable today at web.archive.org/web/20090915223714/http://who.is/whois/nominet.uk. Run the same query against who.is/whois/, whois.com/whois/, and any other WHOIS lookup site you can think of, for your own domain. If anything comes back with a timestamp from before you set your privacy preference, or from a registrar you’ve since left, that’s a stale snapshot worth requesting removal for, covered in Part 6.

Dorking your own name

This needs no special tooling, just a search engine and a few operators:

site:linkedin.com "Your Name"
"your.email@address" -site:yourdomain.co.uk
filetype:pdf "Your Name"
intitle:"Your Name" resume OR cv

site: restricts to a domain, filetype: restricts to a document type, intitle: restricts to the page title, and a quoted phrase forces an exact match rather than a loose one. The -site: exclusion in the second example is useful specifically for checking whether your own email address shows up somewhere other than your own site, PDFs uploaded to conference pages, old forum posts, cached copies of documents you thought were private. None of this needs an account or a paid tool. It’s slow and manual, which is exactly why it’s usually the last thing anyone actually does.

Checking breach exposure without exposing anything further

Have I Been Pwned is the standard, free way to check whether an email address has appeared in a known breach. The website itself is free to use directly; it’s the API for automated, programmatic lookups that now requires a paid key, a change made specifically to slow down bulk scraping. For a one-off personal check, the website is the right tool, not the API.

For passwords specifically, there’s a version of this check that’s genuinely safe to automate, because it never transmits the password, or even a full hash of it, anywhere: the Pwned Passwords range API, using k-anonymity. You hash your password with SHA-1 locally, send only the first five characters of that hash, and get back every breached hash suffix that shares that prefix, then check locally whether your full hash is in the returned set.

$ curl -s "https://api.pwnedpasswords.com/range/5BAA6"
003CD215739D7C1B2218670D26F81408237:2
003D68EB55068C33ACE09247EE4C639306B:29
00658BFD1E05761042698D19D32CD9F1A8F:15
...

5BAA6 is the first five characters of the SHA-1 hash of the password password, chosen here because it’s a known, deliberately non-sensitive example, not because it’s anyone’s real password. The API returns every suffix on record that shares that prefix, each with a count of how many times it’s appeared in known breaches; you compare your own full hash’s suffix against that list without the API ever seeing more than five characters of it. It’s free, requires no key, and is the one check in this entire series that’s genuinely safe to run against your real, current passwords rather than a decoy, precisely because of how little it ever transmits.

Part 6 turns from finding things to fixing them: the actual toggles, the actual opt-out request, and the actual email to send when a stale snapshot needs to come down.