Does the same IP across several events mean the events are connected?¶
title: "Does the same IP across several events mean the events are connected?" card_id: "IP-026" status: "complete" source_document: "https://docs.google.com/document/d/1FA1AVnT1fMUeyFO8nyu5-3OjF_Z-V_8kt0sPl4ezZyY/edit?usp=drivesdk"
Does the same IP across several events mean the events are connected?¶
IP-026 — Does the same IP address across several events mean they’re connected?¶
The same IP address appearing across several events may help link them.
But it doesn’t prove that the same person or even the same device was responsible.
Start with a simple example.
A platform records three successful logins to different accounts from the same public IP address within ten minutes.
That common address may be significant.
It shows that, from the platform’s point of view, the three logins arrived through the same visible internet connection or piece of infrastructure.
That can support the possibility that the events are connected.
But there are other explanations.
Several devices in one home may share the same public IP address through a router.
Hundreds of people in a workplace, hotel, school or public venue may appear behind one address.
Mobile providers may place large numbers of customers behind the same public address using Carrier-Grade NAT, or CGNAT.
VPN users may share the same VPN exit address.
The same applies to proxies, Tor exit relays and some cloud services.
So the repeated address may be linking the events to shared infrastructure rather than to one person.
Time also matters.
The same address appearing across several events within a short period may have more linking value than the same address appearing six months apart.
Public IP addresses can be dynamically reassigned.
An address used by one customer today may be allocated to somebody else later.
That means a matching address at two widely separated times may involve completely unrelated connections.
The surrounding records can strengthen or weaken the possible link.
If the events also share the same account, session identifier, device identifier, browser information or pattern of activity, the repeated IP address becomes one part of a broader connection.
If the only common feature is an address used by a large VPN provider, the linking value may be much weaker.
Source ports can also matter where a public address was shared between several connections at the same time.
An IP address and timestamp alone may not distinguish between them.
It’s also worth reversing the question.
Different IP addresses don’t necessarily mean that the events are unrelated.
One device can move between home Wi-Fi and a mobile network.
A public address can change.
A VPN user can reconnect through a different exit server.
The same person may therefore appear through several addresses during one period of activity.
A repeated IP address is a useful common feature.
Its value depends on what the address represents, how close the events are in time and what other information links them.
It can support a connection between events, but it can’t establish that connection—or identify the person responsible—on its own.