Does the current operator necessarily control the address at the event time?¶

No. An address may be reassigned, transferred, announced differently or used through an intermediary. A current lookup describes the position now, not necessarily the position when the event occurred.

The short version¶

Attribution is time-dependent. Match the address, operator and route to the event timestamp.

What can change¶

Between the event and the lookup:

• a provider may reallocate the address;
• a customer may change service;
• a hosting tenant may be removed;
• a prefix may move between networks;
• an intermediary may change providers; or
• registration data may be corrected.

A current result can still help identify the likely organisation, but it needs historical checking.

A useful analogy¶

A current address lookup is like checking who occupies a flat today when the incident happened last year. It is relevant, but it is not the historical tenancy record.

What to preserve and request¶

Keep the original event time and source record. Ask the relevant organisation about:

• control or allocation at the event time;
• assignment and transfer history;
• routing or announcement at that time;
• customer or tenant records; and
• retention or deletion.

Safe conclusion¶

The current lookup associates the address with organisation A. Historical control at the event time remains to be confirmed by the relevant provider or registry records.