WDH-061 Websites, Domains & Internet Infrastructure
Which provider should I contact first?¶
Contact the provider most likely to hold the record that answers the immediate investigative question, especially where data may be short-lived. Start with the question, not the company name.
What to do¶
Preserve the visible content first. Map the registrar, DNS provider, platform, host, intermediary and payment services. Prioritise volatile records such as access logs, dynamic assignments, security events and platform activity. Use each response to identify the next provider in the chain.
Key takeaway
Contact providers in an evidence-led order rather than a fixed order.