What is the difference between observing a website and attributing responsibility for it?¶

Observation records what the website did or displayed. Attribution asks who created, controlled, authorised or benefited from that activity. They are connected investigative questions, but they are not the same conclusion.

Observation: what was there?¶

A sound observation may establish that a page at a particular URL displayed specified words, images, contact details or payment instructions at a recorded time. It may also capture redirects, downloads and links to other services.

Think of this as photographing a shop window. The photograph may accurately show the sign, stock and advertised telephone number. It does not, by itself, identify who arranged the display or owns the business behind it.

Preserve the full context because pages may be personalised, restricted to signed-in users or changed shortly afterwards. Historical website evidence can help reconstruct earlier versions where the live page has moved or disappeared.

Attribution: who was responsible?¶

Attribution requires evidence linking the observed activity to accounts, decisions and people. Useful sources can include:

• domain-registration and customer records;
• website-platform publication and revision events;
• administrator logins and recovery details;
• billing, merchant and payout records;
• messages discussing creation or operation of the site;
• devices holding authenticated sessions or source material.

A domain registrant may have paid for the address but delegated the website. A platform administrator may have published material for a client. A named company may have had its branding copied. These distinctions matter when deciding what role can safely be attributed to each person.

Keep the two questions visible¶

An investigation can make progress on observation before attribution is complete. Use wording such as “the captured page displayed…” until evidence supports stronger language about its operator or author.

Treat alternative explanations as questions to test rather than reasons to abandon the enquiry. Shared access, compromise and delegation often leave their own account, access and communication records.