Websites, Domains & Internet Infrastructure · WDH-031

I have found a website — where should I start?¶

Start by defining exactly what you found and which investigative question you need to answer. Do not jump directly from a domain or IP address to a person.

1. Preserve the observation¶

Record:

• the complete URL;
• date, time and time zone;
• how the page was reached;
• sign-in state;
• visible content and surrounding context; and
• the capture method.

Do not rely on a screenshot alone.

2. Separate the components¶

Identify:

• domain and subdomain;
• specific webpage;
• apparent platform;
• payment, contact or account details;
• visible infrastructure; and
• any intermediary such as a CDN or reverse proxy.

3. Define the question¶

Are you trying to:

• preserve content;
• identify the registrant;
• identify the administrator;
• link a payment account;
• attribute publication; or
• identify the relevant provider?

Different questions lead to different records.

4. Map the providers¶

Registrar, host, cloud provider, platform, intermediary, payment service and messaging provider may each hold different evidence.