Skip to main content
Websites, domains and internet infrastructure

I have been given a website or domain

Preserve the complete address, time and source before separating the webpage, domain, DNS, intermediary and hosting services. Each layer may hold different records and may be controlled by different people.

Investigate now

Start with what needs doing now

Use this route to preserve a changing website, identify the relevant services and move from visible content towards provider-held evidence.

Start the investigationWork through a website address

Follow a complete URL through preservation, domain and hosting records, administration events and careful attribution.

Reference WDH-001Preserve firstWhat should I preserve from a website?

Retain the complete address, visible state, time, source and supporting context before the content changes.

Reference WDH-026Volatile contentWhat if the website disappears?

Identify what can still be preserved and which providers may retain historical customer, access or deployment records.

Reference WDH-078
Learn

Understand the evidence and the offender method

Use this route to understand how domains and websites fit together and how a separate offender operation creates evidence across providers.

Foundation explanationHow do a domain name and website fit together?

Separate the URL, domain, DNS, intermediary and hosting service before deciding which record answers which question.

Reference WDH-002Separate offender exampleDodgy Dave builds a website that charges for silence

See how a disposable extortion site still depends on registrar, platform, communications and payment relationships.

Reference WDH-106
Common questions

Go directly to the issue you need to resolve

RegistrationWhy is domain registration information hidden?

Understand what a public lookup omits and what a registrar may retain.

Reference WDH-014InfrastructureDoes the website IP address identify the operator?

Use the address to identify infrastructure without treating it as a person.

Reference WDH-019Provider evidenceWhat records might a domain registrar hold?

Identify customer, billing, recovery and event records that may exist.

Reference WDH-029AuthorshipDoes website content prove who wrote it?

Separate publication on a service from the human author or operator.

Reference WDH-039
Browse every Websites, domains and internet infrastructure guidance page The complete reference library remains available when you need a narrower question.