Website forensics modules & options

The Website Forensics search type exposes five Modules in the captured build, all single-purpose — this search type does not offer OneScan. For the composer flow that surrounds these Modules, see Website forensics search: overview.

The Website Forensics Module grid showing the Website Domain Ownership (by Domain) tile selected with a coral-orange border, alongside the by-Email, Website Change History, 3rd Party Website Lookup and Search by Favicon tiles

The Modules

Module	Data source	Input	Cost / cost type	What it returns
Website Domain Ownership (by Domain) (selected by default)	WHOIS (inferred)	Domain name	Free (0 Credits)	Current and historical domain ownership — WHOIS registration data, registration history, and associated contacts
Website Domain Ownership (by Email)	WHOIS reverse-lookup (inferred)	Email address (inferred)	Not captured — see caution	Reverse-WHOIS: the domains registered under a given email address
Website Change History	Internet Archive (inferred)	Domain name (inferred)	Not captured — see caution	Historical page snapshots via the Internet Archive (Wayback Machine); the tile carries a gear for per-Module settings
3rd Party Website Lookup	Not captured	Domain name (inferred)	Not captured — see caution	Aggregates results from external third-party website-intelligence integrations
Search by Favicon	Not captured	Favicon / domain (inferred)	Not captured — see caution	Finds other sites sharing the same favicon (site-icon) hash

Note

Website Domain Ownership (by Domain) is the app’s fixed out-of-box default for this Search type, not a last-used (persisted) selection (per Lee, 2026-07-10). The “selected by default” marking in the table above reflects that fixed default.

Website Domain Ownership (by Domain)

Website Domain Ownership (by Domain) is the lead Module and is pre-selected when you open the Website Forensics search type. Its tile is drawn with a coral-orange highlighted border.

• Returns: the domain’s current and historical ownership — WHOIS registration data, registration history, and associated contacts.
• Input: a Domain Name.
• Cost: the line beneath the input reads “Cost per search: Free” — the Module consumes no Credits per search (see Credits and pricing).
• Data source: WHOIS, inferred from the Module name and not confirmed on screen — see WHOIS.

Website Domain Ownership (by Email)

• Purpose: a reverse-WHOIS lookup — finds the domains registered under a given email address. A pivot from an email to the domains it owns.
• Input: an email address (inferred from the Module name; the field label was not captured).
• Cost: not captured.
• Data source: WHOIS run as a reverse-lookup, inferred from the Module name and not confirmed on screen — see WHOIS.

Website Change History

• Purpose: returns historical page snapshots so you can compare how a site’s content changed over time.
• Input: a domain name (inferred).
• Cost: not captured.
• Data source: the Internet Archive (Wayback Machine), inferred from the Module name and not confirmed on screen — see Internet Archive (Wayback).
• Gear icon: this tile carries a gear — a per-Module settings affordance. The settings behind it were not captured.

3rd Party Website Lookup

• Purpose: aggregates results from external third-party website-intelligence integrations.
• Input: a domain name (inferred).
• Cost: not captured.
• Data source: not captured.

Search by Favicon

• Purpose: finds other sites that share the same favicon (site-icon) hash — a pivot from one site’s icon to others using the same icon.
• Input: a favicon or domain (inferred).
• Cost: not captured.
• Data source: not captured.

The data source behind each Module

Caution

The data sources above are partly inferred and partly uncaptured:

• Website Domain Ownership (by Domain) and (by Email) are attributed to WHOIS (run as a reverse-lookup for the by-Email Module). This is inferred from the Module names, not confirmed on screen. See WHOIS.
• Website Change History is attributed to the Internet Archive (Wayback Machine) — again inferred from the Module name, not confirmed on screen. See Internet Archive (Wayback).
• The data sources behind 3rd Party Website Lookup and Search by Favicon were not captured at all.

Confirm the data source shown on-screen before relying on it. For how Modules map to data sources in general, see How UserSearch works and the data-source integrations index.

OneScan and per-search options

Caution

In the captured build the Website Forensics search type shows no OneScan Module, no Choose Data Source configuration modal, and no per-search filters or entity-type tabs. Each of the five Modules runs on its own against a single data source. This differs from search types such as Username Intelligence or Public Leaks, where OneScan and a Choose Data Source modal are available. See OneScan explained for how OneScan and its Choose Data Source filters work where they are offered.

Per-Module settings

The Website Change History tile exposes a gear icon — the app-wide affordance for a Module that carries its own per-Module settings.

Caution

The options shown behind the Website Change History gear were not captured, so its exact settings are not asserted here. Only the Website Change History tile is confirmed to carry a gear; whether the other four Website Forensics tiles expose gear, help, or tutorial affordances was not captured.

See also: Website forensics search: overview and Reading Website forensics results.

Verified against UserSearch v2.0.20