WDH-035 Websites, Domains & Internet Infrastructure
Which organisation might hold which website records?¶
Match each provider to the role it performs. Different organisations hold different parts of the evidence.
- Registrar: registration account, payment, access, renewals, transfers and domain changes.
- Registry: authoritative domain status, registrar and key registration events.
- DNS provider: configuration and change records.
- Host or cloud provider: customer, infrastructure, payment, access, support and sometimes content or backups.
- Website platform: user accounts, publishing history, administration, messages and store records.
- CDN or reverse proxy: customer, request, security and origin-configuration records.
- Payment provider: beneficiary, transaction and account records.
- Email or messaging provider: account, access and communication records.
- Internet service provider: subscriber data for a public IP address and time.
- Device: browser history, saved credentials, files, communications and administration evidence.
Identify the role before approaching the provider¶
A visible IP owner may only be an intermediary. A registrar may not hold content. A cloud provider may know only a reseller. A platform may hold the most useful records without owning the domain.
Frame the request around the investigative question and relevant period.
Key takeaway
Decide which record could answer the question, then approach the provider most likely to hold it.