Does the current operator necessarily control the address at the event time?¶
title: "Does the current operator necessarily control the address at the event time?" card_id: "IP-072" status: "complete" source_document: "https://docs.google.com/document/d/124Y2b6gAZXjxz17md0-4X9MlE2AlKmBkKLpgdazqCcc/edit?usp=drivesdk"
Does the current operator necessarily control the address at the event time?¶
You perform an IP lookup today and it identifies a particular provider.
Can you assume that provider controlled the address when the event happened?
Not necessarily.
IP address ranges can be transferred between organisations.
A provider can acquire a new range, sell or return an existing one, or delegate part of it to another company.
Routing arrangements can change as well. A different network may begin announcing the range or carrying its traffic.
Even where the same provider still controls the wider range, the individual address may have been reassigned many times between customers.
This is particularly important with dynamic broadband, mobile services, cloud hosting and virtual servers.
The current user of an address may have no connection with the customer who used it during an event months or years earlier.
Public lookup services usually emphasise current registration and routing information.
They may not show the complete history of every transfer, delegation or customer allocation.
A provider contacted solely because it appears in today’s lookup may respond that it did not control the address at the relevant time—or that another part of the service held the necessary records.
Historic registration and routing data can help reconstruct earlier control.
Contemporary case records, saved lookup results, provider responses and other time-specific sources may also be important.
But historic routing information still doesn't normally reveal the individual subscriber.
It helps establish which organisation may have been responsible for managing the address range at the time.
The event date must therefore be used throughout the attribution process—not added only when making the final request.
The result should also record when the lookup itself was performed, because later checks may produce different information.
A current IP lookup is evidence of what the available data says now.
It isn't automatic proof of who controlled, allocated or used the address during an earlier event.
Before relying on the named operator, make sure the network relationship relates to the relevant time.