Journalistiek en Nieuwe Media

Door docenten
#CharlestonShooting: checking the whois, cache en web archive of the suspect’s website

#CharlestonShooting: checking the whois, cache en web archive of the suspect’s website

The news broke that the Charleston church shooting suspect had set up a website containing photos of himself and a manifesto. That website can be useful for journalists and researchers to gain insights in the thinking and doing of the shooter

Checking the whois

The whois of a website provides information on who registered a website and when. Crucial info to assess the authenticity of a website and to find some details about the person of organisation behind a website.

  • Step 1: Go to a whois site, like domaintools and insert the url of the website, in this case (important: this does not work with webpages that are hosted on a meta site like In this case, you can only check the whois of the mother site
  • Step 2: Check the whois info and look for creation date and registrant information (name, address, phone, email, …).

If you notice that the whois details of the registrant are private or refer to a hosting company instead of an individual (which is the case for the website under study), you can try to check the whois history of a website in the hope that earlier versions of the whois information contain some extra data. In order to see this whois archive, you have to go for a free trial of 30 days, or subscribe for a pro account.

  • Step 3: Click on the whois history (see screenshot below) and check for earlier versions to see if there is any ‘new’ information. There appear to be four records with whois information of which the three most recent are made private. The oldest version (2015-02-09) however contains some public information and reveals the name, address, phone and email of the registrant (which is – probably – the suspect of the shooting).

  • Step 4: Now can you cross-platform check the name, address and email of the registrant (in google, social media platforms, …)

Checking the cache

Of course, as a journalist or researcher, you want to check the website itself. Problem: the website is offline. Luckily, Google crawls the web and takes snapshots of the websites as sort of a backup in case the current page is not available (or was taken offline). If you want to check the content of the website that is offline, you should follow the next steps:

  • Step 1: Go to Google and insert: With this search term, you check for pages within this domain that are indexed by the search engine. One search result appears.
  • Step 2: Click on the arrow after the url-link and click on ‘in cache’. By doing so, the snapchat of the webpage containing his manifesto appears.

  • Step 3: This is important information, but still, you are a little bit frustrated because you know that the website also contained some photos, and this page seems not to be part of the cache history of Google. To find these photos, you have to check versions of the website in the web archive.

Checking the web archive

The Web archive (also known as the waybackmachine) is a great tool to find some old or even deleted versions of websites. It is quite entertaining to check old web pages of your own website of those of your news medium, but it can also be used as a research tool to reveal some important data that seems to be missing on a website. Like the photos in the cache of the website under study.

  • Step 1: Insert the url of the website you want to check and click on ‘browse history’.
  • Step 2: Check the dates of the versions of the website that are in the archive. Important: on one specific day, the website can have archived multiple versions. In the case of the suspect’s website, there seems to be only one date in the archive (june 20, not surprisingly the day the news broke). There are eight version on that day in the web archive. Just click on one of them and the website appears, with links that still work. Now you can click on text to see the ‘real’ webpage of the manifesto (the same page we found by checking Google’s cache history) and select photos to open a zip folder containing the disturbing photos.

  • Step 3: Now you can investigate the photos by doing for example reverse images searches (Google image search or Tineye) to check if these photos also appear on other websites (to find for example other websites of the suspect). To make sure that you don’t get news sites covering the news  of the shooting (and the fact that his website was found), you should change the data (by selecting search tools) and specify that you only want web pages that are older than June 20, the day the news broke.

1 Comment

Geplaatst 11 May 2016, 16:40 door Mark


Plaats een reactie

Name (required)

E-mail (required)

Een avatar? Ga naar

Onthoud mij
Hou me op de hoogte van reacties