How do I distinguish infrastructure from responsibility?¶

Infrastructure explains which systems and providers delivered a service. Responsibility concerns who performed, authorised or knowingly controlled the relevant activity.

Identify what each record actually proves¶

An IP address may identify a cloud network. A hosting account may identify an agency. A registrar account may identify the person who obtained the domain. A platform log may identify an administrator session. These are different points in the chain.

The distinction is like identifying a telephone network, subscriber account and person speaking during a call. Each narrows the question, but none should silently be substituted for the next.

Use wording that matches the record. “The domain resolved to infrastructure operated by Provider A” describes a technical result. “Provider A hosted the offender’s website” adds an attribution the lookup does not establish.

Move from infrastructure towards responsibility using customer records, permissions, access logs, configuration changes, publishing history, payments, communications and device evidence. Match the event time across those sources.

Test explanations such as shared accounts, delegated administration, stolen credentials and compromise. Evidence that an account could act is different from evidence that a particular person used it for the relevant act.