What evidence may exist when there is no commercial hosting provider?¶

The evidence is distributed differently. Instead of one hosting account, the chain may run through the ISP, domain services, router and local server.

Reconstruct how traffic reached the device¶

Begin with the hostname and relevant time. Did DNS point directly to a public address? Did dynamic DNS keep that address updated? Did a tunnel or reverse proxy receive traffic? Did the router forward it to an internal device?

Each step can create records:

• the ISP may hold subscriber and address-assignment data;
• the registrar and DNS provider may hold account, payment and change history;
• a dynamic-DNS or tunnel provider may hold updates and connections;
• the router may hold forwarding and administration configuration;
• local network records may map a private address to a device; and
• the device may hold files, databases, logs, credentials and backups.

It resembles tracing a delivery made without a warehouse company: the sender, road network, gate log and destination still record different stages.

Small routers and devices may store little history, and logs can be overwritten quickly. Timely preservation and specialist examination may matter.

The absence of a commercial host does not remove attribution limits. Shared networks, remote access and compromise remain possible.