What is a compromised website used as infrastructure?¶
The practical answer¶
A compromised website can be used to host phishing content, malware, redirects, web shells, stolen data or command-and-control material.
The key evidential caution¶
The dangerous assumption is that the website owner created or supported the malicious content.
They may be another victim.
What investigators should establish¶
Investigators should establish:
Key points¶
- what content or code was added
- when it appeared
- how the site was compromised
- which account or process made the change
- what requests accessed it
- where later traffic was directed
- whether the owner or administrator knew
Relevant evidence¶
Relevant evidence may include hosting logs, content-management records, file changes, administrator logins, web-shell activity, provider data, backups and malware configuration.
A legitimate domain may create trust and avoid blocking.
The malicious content may be hidden from ordinary visitors or shown only to selected devices, locations or referrers.
Evidential limits¶
Do not assume that current site content reflects the state during the incident.
Preserve historical versions, logs and provider records promptly.
The website owner’s account may have been compromised, or a vulnerable plugin may have been exploited.
A compromised site may also host only a redirect or configuration file rather than the final malicious content. Preserve the full request chain. The site may point to another provider or resource that changes quickly, and the visible page may look entirely legitimate to ordinary visitors.
If malicious content was removed during response, preserve the file, path, account and request evidence first. Rebuilding the website may otherwise erase the link between the compromised site and later victim activity.
Operational takeaway¶
Treat a compromised website as both victim system and attacker infrastructure, and prove who inserted and controlled the malicious content separately from site ownership.