How should I search for URLs, domains and IP addresses?¶

Preserve the original indicator, search its meaningful components, and determine whether the source records content, configuration, resolution or network activity.

Break indicators down carefully¶

For a URL, test the full value, hostname, registered domain, relevant subdomain, path, file and distinctive parameter; parameters may carry account or transaction context. Search shortened and lookalike domains through approved safe-analysis routes. IP forms can vary, especially IPv6, and historical ownership or shared infrastructure requires time-specific interpretation.

Let the artefact define the claim¶

Browser history, a message link, cache, API setting, DNS trace and connection log do not prove the same event. For apparent network activity retain protocol, local/remote address and port, application, timestamp and source. Multiple caches and indexes can arise from one event and should not be counted as repeated visits.