WDH-075 Websites, Domains & Internet Infrastructure
How can I tell when a website changed providers?¶
Use several sources to establish when the new service was created, DNS changed, traffic moved and the old service ended.
Evidence to consider¶
- historic DNS;
- nameserver changes;
- provider account dates;
- migration files and backups;
- support tickets;
- invoices and payments;
- certificates and archived captures.
Interpret the result carefully¶
Technical records may identify a service, account, device or request rather than the person responsible. Preserve exact dates, times and time zones, and test shared access, automation, compromise and changing infrastructure where relevant.
Key takeaway
An IP change is a lead, not automatic proof of a provider change.