How do I build a website-attribution investigation?¶

Build attribution as a series of proved links: preserve the reported activity, identify the services involved, obtain the relevant account and event records, then connect those records to people through access, communications, devices and benefit.

1. Define the activity and time¶

Start with the investigative question. Are you trying to identify who published a page, administered the site, received money or authorised a particular change? Those roles may belong to different people.

Preserve exact URLs, page content, redirects, dates, times and viewing conditions. Record what is directly observed and what has been reported by a witness.

2. Map the service chain¶

A website address may involve a registrar, DNS provider, hosting company, content-delivery network, website builder, payment processor and other platforms. Each performs a different job and may hold different records.

Do not assume that the company whose IP address is visible is the website operator. It may only be carrying traffic or protecting the origin server. Hosting-provider records and registrar records answer different questions.

3. Obtain account and event evidence¶

For each relevant provider, identify the account, preservation need and records likely to answer the question. These can include creation details, billing tokens, recovery routes, administrator events, revision history and support communications.

Keep dates and time zones explicit. A later change of provider or domain configuration must not replace the offence-time position; reconstruct the relevant period separately.

4. Connect activity to people¶

Look for corroboration across services: common recovery details, payment instruments, login events, communications, files and authenticated sessions. Device evidence can bridge a provider event to a user, while proceeds or instructions may show benefit and decision-making.

Test shared access, delegation, compromise and false registration details. Record both the evidence supporting attribution and the questions that remain unresolved.

5. Present the chain clearly¶

Use a timeline or evidence table showing each event, source and conclusion. Avoid one large assertion that “the suspect owned the website”. Explain which role each record supports and why the combined evidence is persuasive.