Who operates or announces this IP address?¶

An IP address can be registered to one organisation, announced through another network and used by a customer or intermediary. “Who owns it?” is often too simple a question.

The short version¶

Separate registration, routing and use.

Three different relationships¶

Question	What it may identify
Who is the address registered to?	Registry or allocation holder
Who announces the prefix?	Network operating the route at that time
Who used the address?	Customer, tenant, intermediary or device behind the service

These may be different organisations.

Why that matters¶

A cloud provider may hold the allocation while another network announces it. A reseller may provide service to a customer. A VPN or proxy may use an address registered to a hosting company. The destination service sees the route presented to it, not the full commercial relationship behind it.

What to preserve¶

Record:

• the address and event time;
• registration result;
• routing or announcement result;
• autonomous-system information where relevant;
• lookup dates and sources; and
• the distinction between historical and current results.

Do not treat a current announcement as proof of who controlled the address months earlier.

Safe conclusion¶

The address was registered to organisation A and announced through network B at the time checked. Those results identify infrastructure relationships; they do not by themselves identify the customer or user responsible for the recorded activity.

See whether the current operator controlled the address at the event time and how reliable infrastructure classifications are.