WDH-074 Websites, Domains & Internet Infrastructure
How can I tell which infrastructure served a website at a particular time?¶
Reconstruct the service chain for the exact date and time. A current lookup proves only the present arrangement.
Evidence to consider¶
- historic DNS and IP addresses;
- nameserver history;
- certificate records;
- CDN or reverse-proxy configuration;
- hosting or cloud assignments;
- platform history;
- dynamic-DNS or tunnel records.
Interpret the result carefully¶
Technical records may identify a service, account, device or request rather than the person responsible. Preserve exact dates, times and time zones, and test shared access, automation, compromise and changing infrastructure where relevant.
Key takeaway
Build a dated evidence chain showing provider, intermediary, origin or customer account and the source for each conclusion.