WDH-089 Websites, Domains & Internet Infrastructure
What additional evidence is usually needed to identify the website operator?¶
Provider records are a starting point. Strong attribution usually requires independent evidence linking the accounts, infrastructure and activity to a person.
Evidence to consider¶
- devices with credentials, files and browser history;
- emails and messages discussing the site;
- payments for services and receipt of proceeds;
- platform and hosting access logs;
- authentication and recovery records;
- support and business records;
- advertising, analytics and customer communications.
Keep the conclusion precise¶
Accounts, IP addresses, devices and provider records may identify a technical or contractual relationship without identifying the individual responsible. Test shared access, delegated administration, automation, compromise and changes over time.
Key takeaway
The more independent links point to the same person, the stronger the attribution.