Skip to main content
IP addresses and networks

I have been given an IP address

Preserve the address as part of the complete event: source, UTC time, timezone, account or request identifiers and source port where available. An IP address may identify a connection without identifying the device or person responsible.

Guided route

Start with the practical pathway

Use the short guided route for the first decisions, then go deeper only when needed.

Guided pathwayStart with an IP address

Follow the short operational route from the record supplied to preservation, provider enquiries and cautious attribution.

Investigate now

Start with what needs doing now

Use the guided route for the first decisions, then move into the deeper walkthrough or the urgent safeguarding question when speed matters.

Investigation walkthroughAn online fraud has been linked to an IP address

Work through the complete case from the first address to connection, device, user and corroborated responsibility.

Reference IP-001Safeguarding and speedWhat changes when there is an immediate safeguarding risk?

Balance urgency, lawful authority, preservation and the least intrusive effective action.

Reference IP-109
Learn

Understand the evidence and the offender method

Use this route to understand what an IP address can establish, how network services can obscure it and how an offender may exploit that gap.

Foundation explanationWhat is an IP address?

Understand public and private addresses, allocation, translation and why an address is not a person.

Reference IP-007Separate offender exampleDodgy Dave uses a VPN for a fake marketplace advert

See how a separate offender method creates records across the marketplace, VPN, network and payment services.

Reference IP-121
Common questions

Go directly to the issue you need to resolve

Interpret the recordWhat could the recording system actually see?

Establish where the address was recorded and what that system could observe.

Reference IP-017Several addressesWhich IP address matters?

Separate client, intermediary, internal and destination addresses before acting.

Reference IP-032AttributionHow do I move from a connection to a responsible person?

Test device access, account use, timing and independent corroboration.

Reference IP-080Necessity and proportionalityIs the next request justified?

Match the scope and urgency of the enquiry to the investigative need.

Reference IP-110
Browse every IP addresses and networks guidance page The complete reference library remains available when you need a narrower question.