Can a legitimate website contain criminal content?¶
Yes. Criminal or malicious material can appear on an otherwise legitimate website without the whole organisation being involved.
Possible explanations include:
- user-generated content;
- misuse by an employee or contractor;
- a compromised administrator account;
- vulnerable software or plugins;
- hidden files or pages inserted by an attacker; and
- third-party advertisements or embedded services.
Identify where the content appeared¶
Establish whether it was on the main site, a user profile, seller page, uploaded file, advertisement, hidden page or script loaded from another domain.
Then identify the publishing mechanism and account involved.
Relevant records may include platform logs, content-management history, file timestamps, security alerts, administrator records and access logs. The legitimate owner may also hold incident-response or internal investigation records.
Key takeaway
Do not attribute the content to the domain owner or wider organisation without proving how it appeared and who controlled the relevant account or system.