WDH-090 Websites, Domains & Internet Infrastructure
How do I distinguish the account holder from the person using the website account?¶
The account holder is the recorded customer. The user is the person who performed the relevant activity at a particular time. They may not be the same.
Evidence to consider¶
- account creation and supplied details;
- billing and recovery methods;
- access times and source IPs;
- device and browser information;
- the action carried out;
- authentication and security events;
- communications and evidence of device use.
Keep the conclusion precise¶
Accounts, IP addresses, devices and provider records may identify a technical or contractual relationship without identifying the individual responsible. Test shared access, delegated administration, automation, compromise and changes over time.
Key takeaway
Attribute the action through access and device evidence, not through the account name alone.