ZeroTrace OSINT
Wayback Archive
Time-travel against any URL — snapshot history, content diffs across captures, capture density chart, status-code distribution.
The Wayback tool queries the Internet Archive's Wayback Machine for the snapshot history of a URL, then presents the captures in a structured timeline with diff and density visualisations.
It is the toolkit's "what did this page used to say" tool. Indispensable for investigative reporting where a site has quietly changed text, removed a page, or rebranded.
What you get
For any URL:
| Section | What it surfaces |
|---|---|
| Capture timeline | Every snapshot the Wayback Machine holds for the URL, sorted chronologically |
| First / last snapshot | The earliest and latest dates with a freshness chip |
| Capture density chart | Snapshots grouped by month or year as an inline bar chart — see when interest in the page peaked |
| Status-code distribution | How many captures returned 200 / 301 / 404 / 500 — tells you when the page was healthy |
| MIME breakdown | What content types the captures returned over time |
| Title change column | Page titles per snapshot, with title changes flagged |
| Snapshot diff | Pick any two snapshots and see the text-only diff |
| URL-key alternates | Variations of the same path (different query strings) the archive holds |
The capture timeline
Each row in the timeline shows:
- The date and time of capture (UTC).
- The HTTP status the archive observed at capture time.
- The page title at capture time.
- A direct link to the captured page on the Wayback Machine.
For a URL with hundreds of captures, the table sorts and filters by:
- Date range.
- Status code.
- Whether the title changed compared to the previous capture.
Title change column
A third column highlights when the page title changed between captures. For investigative work:
- A title change from "Acme Corp - About Us" to "404 Not Found" tells you when the page was taken down.
- A title change from one product brand to another tells you when a rebrand happened.
- Repeated title changes between two values tell you the page is dynamic enough that the archive caught different states on different days.
Snapshot diff
Pick any two snapshots from the timeline and see the text diff. The diff is text-only (HTML structure is stripped) so you see actual content changes, not template noise.
For investigative reporting, this is the central feature. A press release that quietly changed wording last Thursday is now visible to the reader of your report.
For a definitive "this is what the page said on date X" quote in a report, the snapshot itself is a public, citable URL on the Wayback Machine. Capture the snapshot URL alongside your finding so anyone reading your report can verify the quote independently.
Capture density chart
A small inline SVG chart shows snapshot counts per month (or per year for very long-lived URLs). Density tells you:
- High density windows — the page was popular or the archive was paying attention. Often correlates with major events.
- Low density windows — the archive lost interest, or the page was unstable.
- Sudden cessation — the URL stopped being archived. Often the URL stopped existing.
Status-code distribution
Aggregate counts of HTTP statuses across all captures. A page with 500 captures of which 480 are 200 and 20 are 404 had a few outage moments. A page that flips to 404 after a date never came back.
URL-key alternates
The Wayback Machine treats different query strings as different URLs. The "alternates" view shows every query-string variant the archive holds for the same path. Useful when:
- The site uses session-bearing URLs.
- The page has multiple parameter-driven variants.
- You want to see captures of "the same page" in the broader sense.
Pivots
| Click on... | Pivot to |
|---|---|
| Snapshot URL | URL parser, redirect analyzer |
| Original target URL | Site analysis, robots/sitemap, security.txt |
| Title text | (no pivot — copy and search) |
Sources
- The Internet Archive Wayback Machine CDX API.
- The Wayback Machine's snapshot endpoints (for the diff fetches).
Every source is named on the result.