How do I link several websites to the same operation?¶

Preserve each website as a separate evidential object, then compare distinctive connections across accounts, payments, administration, content and infrastructure. Several sites looking alike is a reason to investigate, not proof of common control.

Build a comparison table¶

For each site, record the domain, relevant dates, page paths, contact details, payment routes and providers. Keep current and historical observations separate because sites can migrate or deliberately exchange infrastructure.

Useful comparison points include:

• registrar or hosting customer accounts;
• recovery email addresses and telephone numbers;
• billing instruments and payout destinations;
• website-platform administrator accounts;
• login IP addresses and device identifiers;
• analytics, advertising or tracking identifiers;
• matching source files, image metadata or unusual configuration;
• support tickets and migration communications.

Give more weight to distinctive links¶

Thousands of unrelated sites may use the same hosting company, template or public DNS service. Those similarities have little attribution value on their own.

A shared private analytics identifier, unusual administrator email, target reference or source file can be much more significant. The strongest picture usually combines several links held by independent providers rather than repeating information copied from one site to another.

Follow the operation through change¶

Operators may replace domains, copy content to a new platform or move hosting after complaints. Historical infrastructure evidence and dated provider records can show the sequence.

Look for migration events: the same account exporting files, support correspondence about moving a domain, overlapping administration sessions or payment descriptors continuing across sites. These can show continuity even where the public appearance changes.

Keep alternative explanations alive¶

Common developers, agencies, franchises and compromised accounts can create legitimate technical overlap. Establish whether the shared feature points to a service provider, an administrator or the underlying operation.

State the conclusion proportionately: “The sites share these independently verified account and payment relationships” is safer than “the same person ran them all” unless personal responsibility is also proved.