How should I search for URLs, domains and IP addresses?¶
title: How should I search for URLs, domains and IP addresses? subtitle: Break technical indicators into useful components and distinguish a stored string from evidence of a connection or visit. slug: how-should-i-search-for-urls-domains-and-ip-addresses series: mobile-extraction-and-reader-reports section: searching-and-preserving-results card_type: question_card content_type: core-operational risk_level: normal pathway_order: 19 section_order: 6 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 556 estimated_read_time_seconds: 230 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - URL - domain - IP address - web activity sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST Computer Forensics Tool Testing: Mobile Devices' url: https://www.nist.gov/itl/csd/secure-systems-and-applications/computer-forensics-tool-testing-program-cftt/cftt-7 - title: 'Cellebrite Reader: UFDR Report Viewer for Investigators' url: https://cellebrite.com/en/products/cellebrite-inseyets/reader/
How should I search for URLs, domains and IP addresses?¶
Break technical indicators into useful components and distinguish a stored string from evidence of a connection or visit.
Script¶
Technical indicators rarely appear in only one exact form.
A full URL may contain a scheme, hostname, path, parameters, fragment and tracking values.
Start by preserving the original value exactly.
Then search its useful components separately.
For a URL, consider:
the full address;
the hostname;
the registered domain;
a distinctive path;
a file name;
a query parameter;
and any unique account, campaign or transaction identifier.
Don't automatically remove parameters as clutter.
A parameter may identify the user, recipient, document or event.
Search both the domain and relevant subdomain.
login.example.com and files.example.com may represent different services.
A broad search for example.com can reveal related links and application data.
It can also produce false positives where the string appears in copied text, an email, certificate data, a document or a security list.
Now identify the artefact source.
A URL in browser history may support that the browser created a history record.
A URL in a message shows that the content contained or referenced it.
A URL in a cache or thumbnail may result from background loading.
A URL in an application database may be configuration, an API endpoint, remote media or user activity.
A URL in a security product’s data may have been scanned rather than visited by the user.
The string alone does not prove a human browsed to it.
For domains, search the plain domain without the scheme.
Also consider punycode, lookalike spelling and shortened URLs where relevant.
A shortened URL may hide the final destination and may have changed or expired by the time of examination.
Don't visit it from an ordinary device to find out.
Preserve it and use an approved safe-analysis process.
For IP addresses, search the exact textual value.
IPv4 may appear inside URLs, logs, configuration files, messages and application databases.
IPv6 can be written in compressed and expanded forms, so a simple exact search may miss a different representation.
Ask the forensic examiner for help where the representation matters.
Also consider whether the address may have changed over time or been resolved from a domain.
The presence of an IP address in a report does not automatically show a network connection.
It may be content inside a message, a saved server setting, a DNS result, an application endpoint, a log entry or a piece of threat-intelligence data.
If the artefact is a connection or network log, preserve the protocol, local and remote addresses, ports, timestamp, application and source file.
Without those fields, the address may be difficult to interpret.
Expect duplication.
One web event may create browser history, a cache entry, a thumbnail, a cookie, a download record, a DNS trace and an application notification.
Those are several artefacts associated with one activity, not necessarily several visits.
The common mistake is:
“The domain appears 40 times, so it was visited 40 times.”
The hits may be repeated references across databases and caches.
Another mistake is:
“The IP address belongs to this service, so the user connected to it.”
First establish what kind of record contained the address.
A useful search note states:
the original indicator;
the variations searched;
the artefact category;
the source path;
the relevant time;
and whether the record represents content, configuration, resolution or apparent network activity.
Search the components broadly.
Keep the conclusion tied to the source that actually recorded them.
Key takeaway
A URL, domain or IP match is a lead. Establish whether it came from history, content, configuration, cache, DNS, a log or another artefact.
Related questions¶
- How should I search a mobile extraction report?
- How should I search for email addresses?
- How do I record where an artefact came from?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST Computer Forensics Tool Testing: Mobile Devices
- Cellebrite Reader: UFDR Report Viewer for Investigators