How should phishing infrastructure be preserved?¶
Phishing infrastructure can change or disappear quickly, so preservation may be urgent.
Avoid the dangerous assumption¶
The dangerous assumption is that saving the visible webpage or taking a screenshot preserves everything investigators may need.
It does not.
Relevant infrastructure may include:
- the domain name
- DNS records
- hosting account
- web server
- redirect services
- URL shorteners
- certificate details
- cloud storage
- form-submission endpoints
- email-sending services
- telephone or messaging accounts.
Preserve the original link and the complete redirect path where this can be established safely.
Record the date and time, time zone, domain, full URL, resolved addresses, visible content and any identifiers associated with the hosting or service account.
A screenshot can show appearance, but it may not preserve source code, hidden form fields, scripts, submission destinations or server-side records.
Do not browse or interact with suspected infrastructure from an ordinary investigative device. Use appropriate specialist support and lawful process.
Where content is live, a safe capture may be required before takedown or provider action. Where the service is controlled by a third party, consider an urgent preservation request.
Ask providers to preserve account registration, access logs, payment information, uploaded content, configuration, linked identifiers and relevant timestamps where lawfully available.
Be precise about the period and identifier. A shared hosting address may serve many unrelated users.
Infrastructure evidence may link several phishing messages or campaigns. It may identify an account or subscriber. It will not automatically identify the person who operated it.
Record any takedown, suspension or modification because those actions may affect later access to evidence.
Operational takeaway¶
Preserve the domain, hosting, redirect, account and submission records promptly, and do not treat a screenshot or IP address alone as complete infrastructure evidence.