Websites, Domains & Internet Infrastructure · WDH-021

Why does one website use several IP addresses?¶

One website can legitimately use several IP addresses for availability, performance, geography or separate functions. Changing addresses do not automatically indicate changing ownership or multiple operators.

Large services may distribute traffic across several servers. The address returned can depend on location, DNS resolver, time or network conditions.

Different functions may also use separate infrastructure, including:

• the main page;
• account login;
• images and media;
• payments; and
• downloads.

Investigative risks¶

Avoid:

1. treating each address as a separate website or suspect; and
2. treating one current address as representative of the entire relevant period.

Record each result properly¶

Capture:

• the exact hostname;
• date, time and time zone;
• the method and source used;
• the returned address; and
• the provider or intermediary identified.

Historic DNS and provider records may be needed to establish which infrastructure served the domain at the relevant time.