What can an ordinary IP lookup actually tell me?¶
title: "What can an ordinary IP lookup actually tell me?" card_id: "IP-034" status: "complete" source_document: "https://docs.google.com/document/d/1jg-V9b9UKGt9JmjP_ns3-XzwuQEGtQMTWbG83r4L6Fo/edit?usp=drivesdk"
What can an ordinary IP lookup actually tell me?¶
Entering an IP address into an online lookup service can produce an impressive-looking collection of information.
It may show an organisation, internet provider, country, city, network name, domain and even coordinates on a map.
But what has the lookup actually established?
Most ordinary IP lookups combine information from several different sources.
Registration and routing data may show which organisation manages or announces the block of addresses containing the IP.
That organisation might be a home broadband provider, mobile network, business, university, cloud-hosting company, VPN provider or another network operator.
The lookup may also show an Autonomous System Number, usually shortened to ASN. This identifies a network involved in announcing routes for the address. It doesn't identify an individual customer using it.
Reverse DNS may provide a hostname associated with the address. That can offer clues about the provider, network or purpose of the connection, but the name is chosen by the network operator and may be generic or outdated.
Some services classify addresses as residential, mobile, hosting, VPN, proxy or Tor infrastructure.
Those classifications can be useful, but they are assessments made from available data. Different services may disagree, and classifications can become outdated.
Geolocation results may estimate a country, region or city.
That doesn't normally mean the device was located at the displayed point. The location may represent the provider’s network, a routing centre, a registration address or the centre of a broad geographic area.
Some lookup services also display reputation or abuse information.
That may show that the address has previously been associated with spam, attacks or other reported activity. It doesn't prove that the address was being used for the same purpose in the event under investigation.
The information shown may also describe the address now rather than at the time of the event. Address ranges can be transferred, reassigned or used differently over time.
An ordinary lookup doesn't normally reveal the provider’s confidential subscriber-allocation records.
It can't usually tell you which customer had the address at a particular time, which device used the connection or who was responsible for the activity.
Its main value is classification.
It can help establish what sort of network the address appears to belong to, which organisation may hold useful records and what attribution route might be available.
An IP lookup can point the enquiry in the right direction. It is a starting point for attribution—not the answer to it.