Websites, Domains & Internet Infrastructure · WDH-033

How do I identify the evidence chain behind a website?¶

A website rarely produces one decisive record. Build outward from the page through the domain, infrastructure, platform, accounts, payments, communications and devices.

Start with the website¶

Preserve the complete URL, visible content, timing, time zone and route used to reach it.

Trace each layer¶

The chain may include:

1. a domain registered through one account;
2. DNS pointing to a platform or host;
3. a platform account publishing the page;
4. a payment provider receiving funds;
5. an email or messaging account handling enquiries; and
6. a device or connection accessing several of those accounts.

Corroborate across providers¶

Look for repeated:

• email addresses;
• telephone numbers;
• payment methods;
• devices;
• login IP addresses;
• account names; and
• timing patterns.

No single link may prove personal responsibility. The value comes from the combined pattern.

Keep alternatives visible¶

Shared infrastructure, stolen payment instruments, compromised accounts and delegated administration may explain individual links. Record both the connection and realistic alternatives.