Does the same IP across several events mean the events are connected?¶
The same IP address appearing across several events is a useful link. Its strength depends on what the address represents, how close the events are in time and what else they have in common.
Start with what the match shows¶
If three logins reach a platform from the same public IP address, the platform saw them arrive through the same visible connection or network infrastructure.
That supports the possibility that the events are connected. Now establish who or what could have shared that address.
One address can represent many users¶
Several devices in one home commonly share a public address through NAT. A workplace, hotel, school or public venue may place many users behind one connection.
Sharing can be wider still:
- a provider may use carrier-grade NAT (CGNAT);
- users may share a VPN exit address;
- a proxy may sit between the user and service; or
- cloud and hosting systems may generate activity for many customers.
In those cases, the matching address may link the events to shared infrastructure rather than one device.
Time changes the value of the match¶
A repeated address within a short sequence of activity is often more useful than the same address appearing months apart.
Dynamic IP addresses can be reassigned. An address used by one customer today may be used by somebody else later.
Where an address was shared at the same time, the source port and precise timestamp may separate one connection from another.
Build the link with other fields¶
Look for supporting matches such as:
- account or user identifier;
- session identifier;
- device or browser information;
- source port and protocol;
- repeated actions or timing; and
- the same unusual pattern of activity.
Also remember the reverse: different IP addresses do not rule out a connection. A device can move between Wi-Fi and mobile data, receive a new dynamic address or reconnect through a different VPN server.
Operational takeaway
Treat a repeated IP address as a lead linking the events. Then use time, ports, accounts, sessions and device information to work out how strong that link is.
