WDH-056 Websites, Domains & Internet Infrastructure
What evidence may exist when there is no commercial hosting provider?¶
The evidence has not disappeared. It may sit with the ISP, registrar, DNS provider, router, local device or tunnelling service instead.
Potential sources include:
- ISP subscriber and address-assignment records;
- registrar account, payment and access history;
- DNS or dynamic-DNS configuration and updates;
- tunnel or reverse-proxy customer and connection records;
- router forwarding, remote-access and connected-device information;
- local website files, databases, logs, credentials and backups; and
- workplace firewall, DHCP and authentication records.
Map how users reached the service¶
Did the domain point directly to the public IP? Did dynamic DNS update it? Did a tunnel expose it? Did the router forward traffic to an internal device?
Preservation may be urgent because small devices and routers often retain limited logs.
Key takeaway
Follow the service chain into the local network and preserve the records created at each step.