The IP belongs to a home or business ISP - what does that mean?¶
It suggests that the address forms part of an internet provider’s customer network. With the right connection details, the provider may be able to identify the customer service using it at the event time.
The useful conclusion
A fixed-network classification identifies a likely record holder. A provider match may identify a customer connection or account, but not automatically the device, user or responsible person.
What to preserve¶
Before making an enquiry, keep:
- the complete public IP address;
- the most precise date and time available;
- the time zone or UTC offset;
- the source port and protocol, if present; and
- the original event and field labels.
Time matters because a dynamic IP address may move between customers. If CGNAT was used, several customers may share the address at once and the source port can be essential.
Follow the result to the right next record¶
| Provider result | What it may establish | Likely next record holder |
|---|---|---|
| Domestic broadband service | The supplied event fields matched a customer connection/account | Router, Wi-Fi, platform account, device and household-context records |
| Business internet service | The fields matched an organisation's connection or dedicated business connection | Organisation network/security team, authentication, proxy, firewall and asset records |
| Shared or translated service | The public address covered more than one connection or customer | Translation/session records using the complete set of address, port, protocol and time from the same event |
| No match | The supplied fields did not select a retained provider record | Recheck source fields, historical ownership, precision and retention before closing the route |
What the result may identify¶
For home broadband, the result may identify a customer account and service address. For business broadband, it may identify an office, shop, company network or managed connection.
That is a useful step. It moves the enquiry from a public address to a real connection and a likely record holder.
A proportionate description is:
The provider's records associate the supplied public connection details with this customer service at the stated time.
The subscriber result does not, by itself, show which device used the connection or who performed the event.
The supplied event fields were associated with the returned customer service or organisation connection at the stated time.
Which device used the connection, who controlled that device or account, and who was responsible for the event.
Where to go next¶
For a home connection, consider who could use the router, devices and accounts at the relevant time. For a business connection, internal network, authentication and device records may be needed to narrow the activity further.
If the provider cannot make a match, check the supplied time zone, address field and port details before concluding that no useful route exists. Preserve any qualification about shared addressing, retention or the fields that were searched.
