What does an ISP subscriber result actually establish?¶
A provider result usually associates the connection details you supplied with a service, session, SIM or subscriber account at the relevant time. That can be a strong investigative lead. It is not automatically a person-level identification.
Keep the levels separate
Provider match → service/session/account.
Further evidence → device/user/responsibility.
First, read what was actually matched¶
A useful provider response should let you identify:
- the connection details searched;
- the relevant date and time;
- the service, session, SIM or account returned;
- the subscriber or billing details, where applicable; and
- any qualification or limitation stated by the provider.
For fixed broadband, the result may identify a customer account associated with a home or business connection.
For mobile data, it may identify a session, SIM or subscriber account. Where CGNAT was involved, the provider may have matched the public IP address, exact timestamp, source port and protocol against translation records.
Example: a qualified mobile/CGNAT return¶
Request reference: IFD-EX-2041
Supplied public IP: 198.51.100.84
Supplied time: 2026-07-24T20:41:16.482Z
Supplied source port: 51543
Protocol: TCP
Result:
Connection details matched a mobile-data session associated with
SIM reference: SIM-771204
Subscriber account: ACCT-440821
Qualification:
This result identifies the network session/account associated with the
supplied connection details. It does not identify the handset user.
That qualification is not a weakness to be ignored. It tells you exactly where the evidence has taken the investigation - and where it has not.
What is established and what remains open?¶
| Evidence level | Position after the provider return |
|---|---|
| Public connection event | Established from the original service record |
| Provider network/session | Established if the provider matched the supplied fields |
| SIM or subscriber account | Established if specifically returned |
| Particular handset | May still require further evidence |
| Person using the handset/connection | Still requires proof |
| Responsibility for the investigated act | Still requires proof |
The subscriber name is not the finishing line¶
The named subscriber may be the person who used the connection, but several alternatives can exist:
- other household members using domestic broadband;
- employees or visitors using a business connection;
- a SIM held or paid for by one person and used by another;
- a mobile handset providing a hotspot to another device; or
- shared/public network access.
The result should therefore change the next question, not end the attribution exercise.
What should I do next?
Choose enquiries that test the next attribution layer. Depending on the case, useful evidence may include:
- platform and account records;
- router, Wi-Fi or DHCP records;
- handset or device examination;
- household, workplace or access information;
- CCTV, communications, payment or location evidence; and
- admissions or other evidence of control.
For mobile results, also consider SIM-to-handset evidence, hotspot use and whether the account holder was the user. See what changes when the IP belongs to a mobile network.
Describe the result accurately¶
A proportionate wording is:
The provider’s records associate the supplied connection details with this service, session or subscriber account at the stated time.
Then separately describe the evidence that links that service or account to a device, user or person.
Avoid compressing several evidential steps into phrases such as:
“The IP identified the offender.”
That wording hides the very attribution work the investigation still needs to show.
Attribution ladder¶
| Step | Question |
|---|---|
| 1. Event | What did the original service record? |
| 2. Network | Which provider/session matched that event? |
| 3. Account/SIM | What service or subscriber record was associated? |
| 4. Device | Which device could have used it? |
| 5. User | Who was controlling or using that device/account? |
| 6. Responsibility | What evidence connects that person to the investigated act? |
Operational takeaway
A subscriber result is valuable because it moves the enquiry forward. Record the result at the level the provider actually returned, then use independent evidence to climb from connection to device, user and responsibility.
