Who is likely to hold the useful records?¶

The organisation named in a lookup may not hold every record needed. The useful material depends on where the address sat in the route and which event you need to explain.

The short version¶

Follow the record, not just the name attached to the IP address.

Possible record holders¶

Route or infrastructure	Likely record holder
Home or business broadband	Internet service provider and local network owner
Mobile network or CGNAT	Mobile provider and sometimes source platform
VPN or proxy	Intermediary, destination service and account systems
Cloud or VPS	Hosting provider, tenant or application operator
Hotel, café or public Wi-Fi	Venue, managed network provider and destination service
Website behind a proxy or CDN	Application operator, proxy/CDN and origin service

These are possibilities, not guarantees.

Build the record chain¶

Start with the original event and ask:

1. What did the destination record?
2. What address and time did it see?
3. Which network or intermediary sat immediately before it?
4. Which organisation could explain that connection?
5. What separate account, device or payment records may corroborate it?

Preserve the distinction¶

A provider may confirm that an address belonged to its network without holding the application activity. The destination service may hold the event but not the subscriber detail. Several enquiries may therefore be needed.