WDH-098 Websites, Domains & Internet Infrastructure
What is the difference between observing a website and attributing responsibility for it?¶
Observation concerns what the website displayed. Attribution concerns who created, published, controlled, authorised or benefited from it.
Evidence and decisions to consider¶
- screenshots and preserved content;
- domain and infrastructure lookups;
- platform-account activity;
- access and device evidence;
- payments and communications;
- alternative explanations such as compromise or shared access.
Keep the conclusion precise¶
Separate what the website displayed from who controlled the relevant account, infrastructure, payment flow or decision. Test shared access, delegation, false details, compromise, remote administration and changes over time.
Key takeaway
Treat observation and attribution as separate investigative questions.