How do I move from a website address to a person?¶

Do not jump straight from a website address to a named suspect. Move through the service relationships in stages: address to providers, providers to accounts, accounts to activity, and activity to people.

Address to providers¶

Preserve the full URL and relevant time. The domain name can lead to registrar and DNS information, while technical observations may identify hosting, platform or protective services.

These are routes to records, not immediate proof of ownership. A visible IP address may belong to a content-delivery network, reverse proxy or shared host rather than the website’s origin or operator.

Providers to accounts¶

The registrar may hold the account that obtained the domain. A website platform may hold the publishing account. A payment provider may hold a merchant or payout account. Identify which provider performed the action relevant to your investigation.

Account records can include customer details, billing methods, recovery identifiers, creation times, administration events and support correspondence. Public registration privacy does not normally remove the registrar’s underlying customer records; see privacy and proxy registration.

Accounts to activity¶

Separate account ownership from individual events. A named customer may not have performed a particular login or publication. Event times, login addresses, device details, revision history and recovery changes may show how the account was actually used.

Compare those records with the offence-time website position rather than relying only on the present configuration.

Activity to a person¶

The final bridge often comes from corroboration:

• a device holds an authenticated administrator session or matching drafts;
• communications discuss the page or its operation;
• payment records show who received the proceeds;
• recovery details connect several service accounts;
• location and access evidence match relevant events.

Test whether another user, contractor, household member or compromised account could explain the same records. A subscriber, account holder and person at the keyboard may be three different people.