The S&P 500's Forgotten Attack Surface: Legacy Pages the Wayback Machine Never Forgot

We cross-referenced archived-but-still-live admin panels, backup files, and staging endpoints against HackerOne bounty coverage. 92% of companies with a live legacy exposure have nowhere to report it.

NullBlocks Research — August 2026

Most attack-surface conversations focus on what's live today. But the internet has a long memory, and a lot of what a company thought it took down never actually went away. We ran every domain in our S&P 500 dataset back through the Wayback Machine's own archive index, then re-checked every archived URL against the live internet right now. This report is about what we found still answering — and who, if anyone, would actually get paid for reporting it.

Methodology, up front

For all 543 companies currently tracked in our dataset, domrecon pulls the Wayback Machine's CDX index for every known domain, extracts URLs that look like admin panels, backup/config files, or staging/debug endpoints, and then makes a live request to each one right now. A finding only counts as still_live = true if the archived URL still returns a real, non-404 response today — this isn't "it was once online," it's "it is online right now, in production, discoverable from a public archive with zero scanning effort." We then matched every affected company against HackerOne's public Hacker API, the same live data any authenticated hacker account can pull.

1. 198 companies (36%) have at least one legacy URL still answering today

Across the index, we confirmed 4,426 still-live findings total, spread across admin panels, exposed backup/config files, and staging or debug endpoints that were archived — often years ago — and never actually taken offline. Of those, 1,523 are rated HIGH severity, concentrated in exactly three categories:

103 of 543 companies (19%) have at least one HIGH-severity legacy exposure still live right now — a real /admin, /wp-admin, or a backup archive sitting at a URL the company itself likely forgot existed, because nobody re-checks a page after it stops being linked from anywhere.

2. The overlap: 95 of those 103 companies have zero matched HackerOne coverage

Cross-referencing the 103 companies with a confirmed still-live HIGH-severity legacy finding against our HackerOne bounty-coverage dataset: 95 companies (92%) have no matched HackerOne program covering any of their domains at all. That's 1,484 of the 1,523 HIGH-severity findings (97%) sitting on assets with no public bounty program a researcher could report into.

By sector, the gap concentrates hardest in Industrials (18 companies, 368 findings) and Financials (13 companies, 276 findings) — sectors that, in our prior report on subdomain-takeover coverage, showed the same pattern: real, confirmed exposure exists broadly, and paid disclosure infrastructure exists narrowly, and the two barely overlap.

Real examples from the dataset — not hypotheticals:

• A Fortune 500 industrial company with a legacy /admin and /administrator panel still resolving on its main domain.
• A media holding company's wp-admin assets (images, scripts, loading indicators) still served from a subdomain years after the site's public redesign.
• A logistics company with a .zip archive still downloadable from a legacy subdomain, discoverable purely from an old Wayback Machine snapshot.

None of these needed active scanning to find — they were already public, already archived, and simply never re-checked.

3. This is the third exposure class in a row with the same shape

We've now run this same cross-reference three times against three independent exposure classes pulled from our own production data — subdomain-takeover risk, exposed GraphQL introspection, and now legacy Wayback-archived endpoints. Every single time, the result is structurally identical: real, verifiable technical exposure is common. Paid disclosure coverage is rare. The two almost never overlap on the same company. This isn't a one-off anomaly in any single dataset — it's the default state of the S&P 500's public attack surface.

What this means if you hunt bug bounties

1. The Wayback Machine is still one of the highest-signal, lowest-effort recon sources available — a huge share of what we found here required zero active probing, just re-checking what a public archive already indexed years ago.
2. "No bounty program" doesn't mean "don't report it." Check security.txt and Bugcrowd before writing off a finding — this pass only matched HackerOne.
3. Legacy admin panels and backup files are exactly the kind of finding that's cheap to verify and easy to write up clearly — a screenshot of a live, unauthenticated admin login is unambiguous, unlike a lot of theoretical findings.
4. Where a program does exist, prioritize it — but don't assume a target's size or brand recognition means it has one.

Check your own footprint

Everything above came from the same free tool anyone can run right now: domrecon.com — enter a domain, get a plain-English risk grade, version-matched CVEs, full technology stack, and a live Wayback Machine re-check for exactly this class of forgotten exposure. No signup required.

If you want the aggregate, cross-company view instead of one domain at a time — the kind of query that produced this report — that's what we built next: Graph Explorer, continuous scanning of the S&P 500's public attack surface as one interactive graph. See what's in it →

Data as of 2026-08-18, one point-in-time snapshot from our Wayback Machine CDX re-check and nightly HackerOne sync — not continuous monitoring. Spot an error, or want the underlying query for a specific company? Reply — we read every message.

NullBlocks Systems — domrecon attack-surface intelligence.