OSINT Toolkit - Stupid Wayback Tricks

Let’s take a look at “karmicreaction.com”

While researching harmful troll KassandraSeven, I used a little trick that comes in very handy when trying to do a deep search on a website.

KassandraSeven’s old blog is called karmicreaction/com. Don’t go to it now. For some reason if I go to it now it opens up iTunes which is not ideal behavior for a blog.

So, let’s look in the Wayback Machine.

First thing I always look at is the “shape” of the results. This is sometimes, but not always, a good indication of when the site was created, and when it was most active.

The two earliest “hits” are in 2013 and 2016.

Here’s what the results look like for 2013 — just a blank page consistent with someone parking the URL.

That squares up with this WHOIS History Report which is interesting for a number of reasons we’ll return to later.

Whois History Report Karmicreaction

762KB ∙ PDF file

Download

Download

Here’s what 2016 looks like. This is consistent with some sort of maintenance on the site. Green “hits” are redirects and generally worthless. The blue ones indicate a successful crawl and usually have content.

Here’s what the front page looks like... OK. 🙄

Now if we had stopped there, we would have a dead end, but there is more!

If you click “URLs” you get a handy list of all the stored pages under that prefix — in this case karmicreaction/com.

You can sort it all kinds of ways. By date, for example. But the date is from when it was captured not when it was created. The earliest live capture was from September 2016. So it’s often worth scrolling throug the URLs.

Here’s a page that was captured in December 2016, but appears to be an archive from June 2016. This page is deleted from all subsequent archives.

And success! Here are the earliest posts from this website in June 2016. These were deleted for some reason. More tips to come!

https://web.archive.org/web/20161222093518/https://karmicreaction.com/2016/06/