What if the visible provider is only a reseller or intermediary?¶

Treat it as a link in the service chain. The visible provider may identify who received its resource, while a downstream company holds the end-customer relationship.

Follow allocation rather than brand names¶

A cloud company may allocate a server to a hosting reseller. The reseller may divide it between customers. A registrar may deal through a retail partner, and a CDN may front another platform.

The upstream provider can often identify the reseller account, resource identifier, assignment period and billing relationship. The reseller may hold customer, payment, configuration, access and support records.

This resembles a wholesaler supplying a retailer: the wholesaler can identify the shop it supplied, but the retailer records the final buyer.

Timing and exact identifiers are essential because addresses, domains and virtual resources can be reassigned. Ask which downstream account controlled the specific resource at the relevant time, not who controls it now.

Do not skip the intermediary merely because it lacks the final name. Its response can authenticate the assignment and provide the identifiers needed for the next request.

Continue until the chain reaches the account and activity capable of answering the investigative question. Then corroborate that account with access, payment, communication and device evidence.