Start from the domain
Identify the registrable domain, then collect its registration data, DNS records and certificates. The creation date, registrar and nameservers give the first frame of the investigation before any content is reviewed.
Hosting and certificates
Resolve the hostname to IP addresses and identify the network holder. Check certificate transparency for all certificates issued to the name and its subdomains; this can reveal related hostnames such as login, pay or mail portals, and the earliest date the site was prepared for HTTPS.
Content and preservation
Review content from an isolated environment. Note contact details, company numbers, payment instructions and copied text or images. Preserve URLs, timestamps and screenshots, and keep a hashed report so the evidence can be shown to be unchanged.
- Registrable domain and creation date.
- IP address, network holder and hosting provider.
- Certificates and related hostnames.
- Claims on the site checked against independent records.
- Sealed evidence report.
Sources and further reading
crt.sh, Certificate searchRFC 3986, URI syntaxThis resource supports investigative triage. It is not legal advice, an attribution finding or a certification that a website is safe.