If I identify the server, have I identified the website operator?¶
No. Identifying the server identifies infrastructure. Website operation must still be proved through accounts, administration, content, payments, communications and devices.
The server may be rented by a customer, managed by a developer, used through a platform or compromised by an attacker. It may host several unrelated websites, and several people may have administrator access.
Ask the right question¶
Do not ask only who owns the server. Ask:
Who controlled the relevant website service on that server at the relevant time?
Useful evidence may include:
- hosting-account and payment records;
- assigned IP addresses;
- support communications;
- administrator logins;
- configuration changes;
- access history;
- website files and logs; and
- links to other services.
A login may identify an account rather than a person. Credentials may be shared, remote access may be used and the machine may be compromised.
Key takeaway
Preserve both server and provider evidence, then establish who controlled the relevant service and activity.