WDH-060 Websites, Domains & Internet Infrastructure
What should I preserve when I suspect self-hosting?¶
Preserve the whole service chain: the public website, domain and account records, router configuration, local devices, ISP records and any tunnel or dynamic-DNS evidence.
Public evidence¶
Record:
- full URL and hostname;
- public IP address;
- date, time and time zone;
- visible content;
- redirects;
- certificates or error messages;
- route used to reach the service; and
- sign-in requirements.
Supporting infrastructure¶
Potential evidence may exist in:
- the router;
- the device receiving traffic;
- dynamic-DNS accounts;
- domain and DNS records;
- tunnelling or reverse-proxy services;
- ISP records; and
- local firewall or network logs.
The host device may contain files, databases, logs, configuration, credentials and backups.
Small devices may retain volatile data. Powering down, resetting or reconnecting equipment may alter evidence or stop a live service. Seek specialist support where the system is unfamiliar or active.
Key takeaway
Treat the public website and every supporting account, network device and local host as potential evidence.