> Surely there must a technical trail to investigate.

The probably is, but I'm guessing the really definitive records would probably require a subpoena to obtain (e.g. business records of the domain registrar or hosting company).