Members of the Incarnate Word Institute say they don’t know who has access to their websites.<\/p>\n\n
But what does it mean exactly? That they don’t know a password? That they lost contact with a provider? That they can’t identify who manages the main domain of the institution? <\/p>\n\n\n\n
We examined public traces of ive.org<\/strong>. We found a current domain, identifiable vendors, configured institutional email, and signs of recent technical activity. The results do not reveal who has the passwords. They do allow us to ask specific questions that the IVE should answer. <\/p>\n\n The first part explains the findings in everyday language. The second part presents the technical data and their limits, for those who want to examine the basis of the research. <\/p>\n\n The domain ive.org has an expiration date of March 2, 2027<\/strong>. The records consulted show recent administrative changes. This does not allow you to determine the exact date of renewal or who intervened: a change of the record and a renewal are separate operations. <\/p>\n\n The domain is registered through Network Solutions. Its public internet address allows the hosting infrastructure to be identified. The email logs point to Google servers. <\/p>\n\n We are not, therefore, dealing with services that are impossible to locate. There are specific providers from which it is possible to investigate who contracted the accounts and what mechanisms exist to recover them. The fact that this information does not appear publicly does not prove that the institution lacks the means to obtain it. <\/span><\/strong><\/p>\n\n The October 1, 2026<\/strong> check found web style files with modification dates of that same day. One of them is associated with the home page. Between the September and October observations, some version identifiers of the resources served by the site also changed. <\/p>\n\n That doesn’t prove that someone came in that morning to edit the front page. Automatic updates, caching processes, or file regeneration can produce changes without immediate human intervention. <\/p>\n\n What the answers examined do show is that the infrastructure works and shows recent signs of technical processing. A website can preserve old texts while its components change. The age of its publications is not enough to describe it as completely abandoned. <\/p>\n\n The public mail configuration includes soporte@ive.org<\/strong> as the recipient address for technical reports on message authentication.<\/p>\n\n We do not know if that directorate receives the reports or if anyone reads them. But it is in a specific configuration. It is another clue: who created it, who manages it, can it be used to locate the technical manager?<\/p>\n\n It is possible that certain members of the IVE do not know the credentials. Public research does not allow us to establish what each person knows. But this individual ignorance does not solve the institutional question. <\/p>\n\n Who contracted the domain? Who receives the hosting bills? What addresses are used to recover the accounts? Who manages the mail? Have the providers been contacted to clarify this? <\/p>\n\n If the services work automatically, it must be clarified under which accounts and contracts. If they are managed by an external company, it must be identified. If the credentials were lost, it must be explained what steps were taken to recover them and with what result. <\/p>\n\n There may be real difficulties. What is lacking, in the explanation conveyed to the author, is a verifiable description of those difficulties. <\/p>\n\n The evidence does not prove a deliberate lie by a given person.<\/strong> Nor does it prove that the superiors of the IVE know the passwords. Presenting it like this would go beyond what was observed. <\/p>\n\n But the findings do allow us to question the sufficiency of the answer. The domain is current, the services have identifiable providers and the site has recent technical activity. There are specific points from which to investigate its administration. <\/p>\n\n There is no need to divulge passwords or compromise the security of the website. It is enough to identify the responsibilities, specify what control the institution retains and document the steps taken to recover what it says it does not know. <\/p>\n\n Saying “we don’t know” can be the beginning of an investigation. It shouldn’t be your conclusion. <\/strong><\/p>\n\n The following observations are from the public consultations conducted on 18 September and 1 October 2026<\/strong>. They are dated observations: the responses of the services may change. The links allow the consultations to be repeated, but they do not guarantee that they will reproduce the historical results. <\/p>\n\n Examined RDAP and DNS records, HTTP headers, HTML, sitemaps, and public WordPress REST API responses. No credentials were used, no login was attempted, and no attempt was made to circumvent access controls. Times are expressed in UTC unless otherwise stated. <\/p>\n\n The RDAP registry of Public Interest Registry<\/a>, operator of .org, and the RDAP registry of Network Solutions<\/a>, registrar of the domain, were consulted.<\/p>\n\nA current domain and identifiable services<\/h2>\n\n
The site features recent technical activity<\/h2>\n\n
A support address on the domain itself<\/h2>\n\n
“We don’t know” needs an explanation<\/h2>\n\n
What the data allow us to affirm<\/h2>\n\n
\n\nWhite Paper: Data, Sources, and Limits<\/h2>\n\n
1. Domain registration<\/h3>\n\n