Certification & Online Trace Collection · service active
WACZ · ISO 28500/ eIDAS timestamping/ Client area
C.E.R.T.O.
Sign in Register for free
IT EN
C.E.R.T.O. / OSINT / Website history
OSINT · HISTORY

Website history

What a page said in the past, and where it was hosted. Two public archives, two different questions.

Free

It consumes no slots and has no usage limits: it is included in C.E.R.T.O. Desktop and available to anyone with an account.

The result is sealed in a bundle with an Ed25519 signature and an RFC 3161 timestamp, with a report in text and PDF.

Two sources, because they answer two questions that do not overlap. The Internet Archive keeps the content: what the page said, and between which dates it changed. urlscan.io keeps the infrastructure: at which address, with which network operator and which certificate the site was published at each scan.

🔴 Whoever uses only one believes they have answered the other question too. Together they say things neither shows alone — “on 2 October 2021 the site moved from one provider to another” — and that nobody usually thinks to look for.

What goes into the bundle

What it establishes

Only what the program actually does: every item matches a finding that exists in the code.

The distinct versions of a page

How many times the archived content changed, when, with each version's fingerprint and the link to the preserved copy.

The hosting succession

Address, network operator and certificate issuer at each public scan, ordered in time: you can see when the site moved.

Which pages turn out to be archived

In “whole domain” mode, the list of addresses for which a copy exists — often including pages the site no longer links to.

Honesty first

What this check does NOT tell you

A stated limit is worth more than a claim of completeness — and it goes into the report too, not just onto this page.

🔴 Absence proves nothing. Archive coverage is irregular, and a public scan exists only if someone requested it and made it public. “Not found in the archive” does not mean “it did not exist”.

These are not proofs produced by C.E.R.T.O.: they are third-party observations, on third-party schedules and criteria. A version's fingerprint is that of the archived content, not of the bytes served at the time: it tells versions apart, it does not certify the original.

You learn between which two observations something changed, never the exact day. And a rate-limit refusal is never passed off as “no results”: it is stated up front, because mistaking it for an absence would lead to concluding there was nothing, when in fact nothing was looked at.

FAQ

Frequently asked questions

The questions we are asked most often about this check.

Does the site notice when the archives are queried?
No. Only existing archives are read: the examined site is never contacted. In particular nothing is submitted for scanning, and that is deliberate: submitting an address to urlscan would make it public, which during an investigation is the last thing you want.
Can I prove a page was modified?
You can show that between two observations of a public archive the content differed, and attach both copies. You cannot infer the exact day or who did it. If instead you hold two of your own acquisitions of the same address, C.E.R.T.O.'s Comparison module works on your own evidence and states exactly what changed.
How much does it cost?
Nothing. It was deliberately made free: as a paid service, a single query of this kind would not be worth its price.
Same section

The other OSINT checks

All inside C.E.R.T.O. Desktop's OSINT section, all with their own sealed bundle.

Website history, free.

Register and download C.E.R.T.O. Desktop for Windows and macOS from your client area.