What is a content-delivery network?¶
A content-delivery network, or CDN, distributes website content through servers in different locations. Its public IP address identifies delivery infrastructure, not automatically the origin host or website operator.
A CDN can improve speed, absorb traffic and help keep a service available. Different users may receive different addresses depending on location and network conditions.
What changes for an investigator¶
The visible IP may belong to the CDN rather than the server holding the original content. Many unrelated sites may also share the same CDN infrastructure.
Possible CDN records¶
Depending on the service and relevant period, the provider may hold:
- customer-account details;
- configuration records;
- request or traffic logs;
- security events; and
- information about where requests were forwarded.
The CDN may not hold the website’s underlying content or publishing records. Those may sit with the origin host, website platform or customer.
Frame the enquiry precisely¶
Be clear whether you need information about:
- the CDN customer;
- traffic handled;
- security activity; or
- the origin configuration.
Key takeaway
Treat the CDN as an intermediary and evidence holder. Use it to trace the service chain rather than assuming its address identifies the origin or operator.