Websites, Domains & Internet Infrastructure¶

105 investigator questions.

Use the list below or search the complete library.

• I have been given a website address — what am I actually looking at?
• What is a domain name?
• What is the difference between a domain and a website?
• What is a subdomain?
• Can one website use several domain names?
• What is a webpage?
• What does the part after the final dot mean?
• Can one domain host several websites?
• Who registers a domain name?
• What is a domain registrar?
• What is a domain registry?
• Who is the domain registrant?
• Does the domain registrant own or operate the website?
• Why is domain registration information hidden?
• What is domain privacy or proxy registration?
• What is website hosting?
• Who is the hosting provider?
• Does the hosting provider own or operate the website?
• Does the website IP address identify the operator?
• Why do several websites share one IP address?
• Why does one website use several IP addresses?
• What is cloud hosting?
• What is a content-delivery network?
• What is a reverse proxy?
• Why does the IP address belong to Cloudflare or another intermediary?
• What should I preserve from a website?
• Is a screenshot enough?
• How do I record the exact webpage I viewed?
• What records might a domain registrar hold?
• What records might a hosting provider hold?
• I have found a website — where should I start?
• How do the domain, website, registrar, registrant and hosting provider fit together?
• How do I identify the evidence chain behind a website?
• How do I distinguish infrastructure from responsibility?
• Which organisation might hold which website records?
• What does controlling a website actually mean?
• Can I identify the website operator?
• Who published the content on the website?
• Does website content prove who wrote it?
• What evidence best links a person to a website?
• Can one person operate several websites?
• Can several people operate one website?
• Can a legitimate website contain criminal content?
• Can a website be compromised without the owner’s knowledge?
• If I identify the server, have I identified the website operator?
• What is a virtual private server?
• What is the difference between shared hosting, a VPS and a dedicated server?
• What is self-hosting?
• Can somebody host a website from home?
• Can a website be hosted from an ordinary broadband connection?
• What is dynamic DNS and why might a website use it?
• What does port forwarding have to do with home hosting?
• Can a website be hosted from a compromised device?
• Does a residential IP address mean the website operator lives there?
• Does the website IP identify where the physical server is located?
• What evidence may exist when there is no commercial hosting provider?
• Could the website be exposed through a tunnelling service?
• Could a website be running from a NAS, router or other small device?
• Can a website move between home hosting and commercial hosting?
• What should I preserve when I suspect self-hosting?
• Which provider should I contact first?
• Who is most likely to hold the records I need?
• What should I ask a domain registrar for?
• What should I ask a hosting provider for?
• What should I ask a website platform for?
• What records might a website platform hold?
• What records might a content-delivery network hold?
• What records might a reverse-proxy provider hold?
• What records might a cloud provider hold?
• What if the visible provider is only a reseller or intermediary?
• How can I find out what a website looked like in the past?
• How can I tell who hosted a website in the past?
• How can I tell who registered a domain in the past?
• How can I tell which infrastructure served a website at a particular time?
• How can I tell when a website changed providers?
• How can I tell whether website content has changed?
• What can an archived version of a website prove?
• What should I do if the website disappears?
• How do I preserve interactive or personalised website content?
• What should I preserve from redirects and shortened links?
• Can I prove somebody visited a website?
• Can I prove somebody viewed a particular webpage?
• Can I prove somebody downloaded a file from a website?
• Could a browser or application contact a website automatically?
• Does a server log prove a person viewed the content?
• Can I prove somebody uploaded content to a website?
• Can I prove somebody managed a website account?
• Can I prove somebody operated a website?
• What additional evidence is usually needed to identify the website operator?
• How do I distinguish the account holder from the person using the website account?
• Does a page on a platform identify the platform as the publisher?
• Who controls a seller page, profile or storefront?
• Can different users publish content under the same website?
• Can one user control several pages, profiles or stores?
• Who holds the records for content published on a platform?
• What can and can’t a website prove?
• What conclusions can I safely draw from website evidence?
• What is the difference between observing a website and attributing responsibility for it?
• Does branding, a logo or a company name prove who operates the website?
• Does a contact address or telephone number on a website identify the operator?
• How do I build a website-attribution investigation?
• How do I move from a website address to a person?
• How do I link several websites to the same operation?
• When should I seek specialist support for a website enquiry?
• When is a website line of enquiry worth pursuing?