Website History OSINT: Build a Timeline You Can Defend

Investigate one historical claim, not “the whole website”

“Check this website’s history” sounds clear until the search begins. It may mean: when did the domain appear, when did a page first mention a service, when did contact details change, or whether a company’s “since 2018” claim is supported. Each question needs different evidence.

Write one testable sentence before opening an archive. For example: Was the consulting service described on the public site before 1 July 2026? Then list the exact URL or section, the date boundary and the wording that would count as a match. This prevents a later snapshot of the homepage from being mistaken for proof about an older service page.

Keep three clocks separate

A reliable timeline names the clock in every row. “First seen on 15 July” is safer than “launched on 15 July” unless another source documents the launch itself. If the first available capture is late, record the gap rather than moving the date backward.

Use each source for the question it can answer

Live pages show the current claim

Preserve the live URL, visible text, title, canonical, relevant links and retrieval time before comparing older versions. Dynamic pages may change while you work. Save an untouched copy or a documented capture when the task and site rules allow it.

Web archives preserve observations, with gaps

The Internet Archive explains that Wayback Machine coverage is not guaranteed and that broken images can mean required assets were not stored. Its Save Page Now guidance also notes that a submitted page is saved individually rather than crawling the entire site. A missing capture therefore means “not observed here,” not “the page did not exist.”

RDAP describes current registration data

ICANN’s RDAP overview describes a structured replacement for WHOIS. Registration events and nameservers can help frame a domain timeline, but privacy rules and registrar practices limit returned data. A registration date is not the date a company began trading, and the visible registrant may be redacted.

Certificate Transparency records certificate events

RFC 9162 defines append-only logs for publicly issued TLS certificates. A certificate timestamp can show that a certificate or precertificate for a name was logged. It does not prove the site was publicly reachable, controlled by today’s operator or carrying the page you are investigating.

Independent publications test the site’s story

Regulator pages, partner announcements, official event programs and reputable reporting can support or contradict a self-published claim. Count underlying sources, not URLs: ten sites that repeat the same press release remain one source chain.

A seven-step website history workflow

1. Freeze the question. Define the claim, target page and date boundary.
2. Preserve the current state. Record the URL, retrieval time, visible claim and a hash or other integrity note for saved material.
3. Build a URL family. Include known language paths, old slugs and relevant subpages discovered from public links. Do not guess private endpoints.
4. Collect archive captures. Record successful captures and meaningful gaps. Inspect the exact page, not only the homepage.
5. Add infrastructure events. Note RDAP events and certificate-log observations as separate evidence types.
6. Find an independent anchor. Search the exact claim, organization and date in sources outside the investigated site.
7. Write the assessment before collecting more. State what is supported, what is contradicted and which missing evidence could change the conclusion.

Claim under test: __________________________
Date boundary: ____________________________
Target URL or page family: _______________

Observed at | Source clock | Exact observation | Supports | Does not prove
------------|--------------|-------------------|----------|---------------
            |              |                   |          |

Assessment: supported | partly supported | contradicted | unresolved
Confidence reason: ________________________
Known gap: ________________________________

Worked example: a long history claimed by a young web footprint

This example is fictional. It uses the reserved .example namespace and does not describe a real organization, customer or OSINT Jet result.

northbridge-advisory.example currently says, “Independent risk advice since 2018.” The task is to find out whether public web evidence supports that date.

The result is not “the claim is false.” The defensible assessment is: “Public evidence reviewed supports domain and web activity from June 2026 and an independent relationship in July 2026. No reviewed source independently supports the claimed 2018 start date. Because archive coverage is incomplete, the earlier history remains unresolved.”

That wording protects both sides of the evidence. It refuses to convert a missing archive into proof of absence, while refusing to accept a self-published date as independent confirmation.

Make the timeline reviewable

Keep each capture, RDAP response, certificate event and third-party page as a separate evidence item. Store the source URL, retrieval time, relevant observation and the clock it represents. If a page was rendered through an archive, record both the original URL and the archive URL.

OSINT Jet can help organize the domain, archived claims, infrastructure events and independent pages as connected findings in one investigation. Its useful role is keeping the clocks and contradictions visible for human review. It cannot fill archive gaps, prove a business existed before its public records or turn a certificate date into a launch date.

Use the domain OSINT guide for the current domain, the company verification workflow for business claims, and the report template to document the timeline.

Organize website history evidence in a reviewable case

Questions people usually ask

Does the first Wayback capture equal the website launch date?

No. It is the earliest capture available in that archive for the URL you checked. The page may have existed earlier, under another path or outside the archive’s coverage.

Can a domain registration date prove when a company started?

No. It dates a domain event. A company may predate the domain, acquire it later or change legal entities.

Does a certificate log prove a website was live?

It shows a certificate-related event for a domain name. It does not by itself prove public reachability, page content or current control.

What if an archived page loads without images or scripts?

Record the missing assets and avoid inferring what they contained. Seek another capture or independent source rather than reconstructing the missing content from assumption.