Archive of WHOIS records: every successive version of a domain's record, including those from before privacy protection was switched on. It also works backwards (reverse WHOIS): search for an e-mail or a name to list every domain that used it.

In real life: DomainTools (Whois History, Reverse Whois), WhoisXML API, ViewDNS.info. Many fraudulent domains expose their owner during the few hours or days before protection is switched on. Careful: a privacy service's e-mail is shared by thousands of domains, it links nothing.