I have been given a website address. What happens next?¶
A specialist reporting body refers a complete web address used to distribute suspected indecent imagery. Its report includes the precise URL, the time it was accessed and the provider reference AR-184. This walkthrough follows the website and its surrounding infrastructure towards a suspect without describing or unnecessarily reproducing the reported material.
The strongest route is usually cumulative: the reporting record fixes the resource; providers identify the relevant accounts and events; device evidence helps connect their use to a human being.
The referral¶
https://northmere-archive.example/member/collection/AR-184AR-184; reported object IMG-8841; cryptographic hash supplied separately.The complete URL identifies a particular resource and path. The supplied hash provides a way to compare the reported object with provider or device material without relying on its filename or appearance. Preserving the exact webpage and its context matters because a copied domain name would lose the path, time and reporting reference that make the observation useful.
SR-62018.Work the website as evidence¶
01 · Preserve the referral before following the site
The valuable starting point is the combination of URL, UTC time, object identifier, hash and reporting reference.
Retain the original referral and record how it was received. Do not reduce it to a screenshot or a handwritten domain. Where further capture is necessary, use the organisation's established handling arrangements so that investigators do not create avoidable copies or browse beyond the evidential purpose. What should be preserved from a website and when a screenshot is insufficient depend on what the page may change or conceal.
The hash does not identify who possessed or published the object. It does provide a precise comparison point if the same file later appears in a hosting return, archive or device examination.
02 · Separate the visible address from the services behind it
The domain uses privacy-protected registration, managed DNS and an intermediary service in front of a separate host.
A domain is not the website. A registrar manages the registration; DNS directs requests; an intermediary may protect or accelerate traffic; and a host or platform makes the content available. The registrant may not be the site operator, and the organisation named against a visible IP address may only be carrying traffic for its customer.
The intermediary is therefore a positive line of enquiry, not an attribution and not a dead end. Its records may identify the customer configuration or origin service. Why a visible address may belong to an intermediary explains why current lookups must be read as routing evidence.
northmere-archive.example used the identified registrar, DNS and intermediary services at the time checked.03 · Reconstruct the infrastructure at the reported time
Historical records show the domain, DNS route and first hosting deployment being created through linked accounts within 34 minutes.
A live lookup describes the present. The evidential question is what served collection AR-184 on 12 June. Seek the records a registrar may hold, the records available from a hosting provider and evidence of which infrastructure served the site at a particular time.
REG-6204 creates the domain using billing token tok_reg_6C21.WEB-11872.DEP-6312 are recorded.The short sequence strongly connects the service accounts to the construction of one functioning site. It does not yet name the person at the keyboard, but it creates precise account, deployment and billing events that can be tested elsewhere.
04 · Work the customer and administration records
The registrar and hosting returns contain the same recovery address and mobile ending 5831; the registration payment resolves to Adrian Kells.
Repetition across independent provider records is a strong line of enquiry to Adrian. It is still account evidence: the email could be compromised and the payment method borrowed. The next question is what evidence links a person to control of a website.
Hosting audit records show deployment DEP-6312 and later administration from 198.51.100.86. Relevant-time subscriber information associates that connection with service installed at Adrian's address. An IP address recorded in a website log does not identify the user, but it corroborates the customer, account and time evidence and gives the device enquiry somewhere sensible to go.
05 · Join publication to possession and control
A laptop lawfully recovered from Adrian contains an active session for WEB-11872, deployment material for DEP-6312 and a file matching the reported hash.
The browser profile records access to the hosting administration pages around the provider event times. Local project files match the site structure and provider deployment manifest. The presence of object IMG-8841 is established through its hash; the evidence does not depend on an investigator interpreting or repeatedly opening the file.
This is a strong circumstantial combination. Registration payment, repeated recovery details, relevant-time network records, an active hosting session, matching deployment files and possession of the reported object all point in the same direction while coming from different sources. The evidence now supports a focused account from Adrian and enquiries into any other administrator rather than an abstract search for “the owner of the internet”.
