Who is most likely to hold the records I need?¶

The likely holder is the organisation whose system created the record. Website evidence is distributed because each provider performs a different role.

Work backwards from the record¶

A registrar creates domain-account and change records. A DNS provider records configuration. A host or cloud company records infrastructure customers and assigned resources. A website platform records users, permissions and publishing activity.

A CDN or reverse proxy may record its customer, requests and origin settings. A payment service records transactions and beneficiaries. An ISP records public-address assignment. Devices and communication accounts can show who actually used or directed those services.

This is similar to a card purchase: the shop, payment processor, bank and delivery company each know something different because each handled a different stage.

The company visible in a lookup may not be the holder you need. An IP owner may be an intermediary, a cloud provider may know only its reseller, and a registrar may have no page content.

State the question precisely: customer identity, publication, access, payment, location or personal use. Then identify the system that would have had to process that event.

Retention and time matter. Confirm the relevant provider and product as they existed during the event, not just today.