I have a destination IP address. Can I tell which website was visited?¶
title: "I have a destination IP address. Can I tell which website was visited?" card_id: "IP-043" status: "complete" source_document: "https://docs.google.com/document/d/1305WJDc3vZ28eJnguoolirRM7lwYX8LoO2WcMP-XdsE/edit?usp=drivesdk"
I have a destination IP address. Can I tell which website was visited?¶
An investigator is given a destination IP address and told:
“This is the website the offender visited.”
But does the address actually identify one website?
Not necessarily.
The first problem is that devices connect to IP addresses, but websites are normally identified by names.
One IP address may support hundreds or thousands of different websites through shared hosting, a cloud platform, reverse proxy or content-delivery network.
The recorded address may therefore identify the infrastructure that received the connection—not the particular website requested.
The second problem is that the traffic may not have involved a website at all.
A destination port such as 443 commonly indicates encrypted web traffic, but other applications can use the same port. The port suggests the type of communication; it doesn't prove which service or content was accessed.
Even if the domain can be identified, that still may not show the particular page visited or what the user did there.
So what can the investigator do next?
Start with the original record.
Check whether it contains more than the destination IP address. Look for a hostname, domain, URL, destination port, protocol, timestamp or an SNI value showing the named service requested during an encrypted connection.
A web proxy or secure web gateway may have recorded the hostname or full URL. A firewall may have recorded only the address and port. Understanding the recording system determines what the evidence can support.
Next, consider DNS records.
DNS-query logs, a device’s DNS cache or other network records may show which domain names were looked up around the same time.
But timing must be compared carefully. A DNS lookup doesn't prove that the subsequent connection was completed, and cached DNS answers may allow a connection without a new query being recorded.
The device itself may contain stronger information.
Browser history, downloaded files, cached content, cookies, application records or other artefacts may identify the named service and help show what happened there.
Historical or passive-DNS services may identify domains associated with the destination address at the relevant time. This can generate useful candidates, but shared infrastructure may produce a long list and the association isn't proof that one of those domains was visited.
Where necessary and proportionate, the operator of the website, hosting service or intermediary may hold access records. Any request would need the available connection details and should be made before relevant records disappear.
Sometimes the original evidence contains only a destination IP address and nothing capable of distinguishing the hosted services.
In that situation, it may not be possible to identify the website reliably.
The accurate conclusion is that the device apparently communicated—or attempted to communicate—with the recorded IP address. Identifying the particular website requires additional evidence showing which named service was requested.