Websites, Domains & Internet Infrastructure · WDH-053

Can a website be hosted from a compromised device?¶

Yes. An attacker can use a computer, server, router, NAS or other connected device to host pages, files or redirects without the owner’s knowledge.

The visible IP may therefore identify the victim’s connection or device rather than the person controlling the website.

Test the compromise explanation¶

Look for:

• unexpected accounts;
• remote-access tools;
• malware;
• new services;
• altered configuration;
• unexplained files;
• administrator logins;
• unusual processes or connections; and
• router forwarding or remote-management changes.

The relevant evidence should show how the service was created and controlled. Compromise is a realistic alternative explanation, not an assumption to accept automatically.