# Network Attribution ## Identification Network attribution is the disciplined connection of observed domains and addresses to routing organizations, ASNs, DNS and TLS history, processes, interfaces, and timestamps. ASN ownership and proxy endpoints must not be mistaken for physical origin location. ## Notebook evidence - [[Scanned_20260730-1659#PDF page 33 — Cloudflare firewall and autonomous-system numbers|PDF page 33: Cloudflare firewall and autonomous-system numbers]] — The listed ASNs correctly identify major network operators: Google AS15169, Meta/Facebook AS32934, Microsoft AS8075, OVH AS16276, and Amazon AS14618. An ASN identifies a routing domain, not an individual server or application. Cloudflare’s proxied DNS uses its anycast network to answer for customer hostnames and can obscure the origin address from ordinary DNS lookups. The page was building a firewall/attribution table that connected traffic to infrastructure owners. - [[Scanned_20260730-1659#PDF page 34 — Network geolocation, AT&T ASN, OID, SMI, and IANA|PDF page 34: Network geolocation, AT&T ASN, OID, SMI, and IANA]] — This is a field investigation into why geolocation services disagreed. IP geolocation is probabilistic and commonly maps provider address space to registration, network, or inferred access locations rather than a precise device. AS7018 belongs to AT&T; the page tests San Antonio, Kenedy, Karnes County, Corpus Christi, and other hypotheses against two IPs. The OID arc `1.3.6.1.4.1` is the IANA Private Enterprise Number branch, used by organizations in SNMP/SMI and other ASN.1-based identifiers. - [[Scanned_20260730-1659#PDF page 35 — Firewall, port discovery, cloud, and iPhone identity checklist|PDF page 35: Firewall, port discovery, cloud, and iPhone identity checklist]] — This checklist spans conceptual filesystem questions, firewall completion, port discovery, licensing software, cloud hosting, device repair, and iPhone interface settings. The opening idea—that files can be represented as images and move between partitions—appears to be an intuition about abstraction layers or disk-image containers, but it is not technically articulated enough to validate. - [[Scanned_20260730-1659#PDF page 38 — Cloud, analytics, and router-domain blocklist|PDF page 38: Cloud, analytics, and router-domain blocklist]] — This is a manually curated network-deny list mixing cloud storage, CDNs, analytics/customer-experience platforms, email/productivity infrastructure, font delivery, and router-administration domains. Several strings are misspelled or may be app-specific subdomains; they must not be treated as confirmed ownership mappings. Apple’s privacy-manifest model now explicitly distinguishes domains contacted for tracking, illustrating the later institutionalization of the notebook’s manual domain-attribution practice. - [[Scanned_20260730-1659#PDF page 39 — Telemetry, advertising, payment, and analytics domains|PDF page 39: Telemetry, advertising, payment, and analytics domains]] — The list moves deeper into mobile telemetry and advertising supply chains: crash/analytics endpoints, communications infrastructure, payment/subscription services, ad exchanges, bidders, and behavioral analytics. Blocking all entries indiscriminately could break core functionality; the page is better understood as **attribution before policy**. - [[Scanned_20260730-1659#PDF page 65 — Cloud-provider and identity architecture dated August 8, 2021|PDF page 65: Cloud-provider and identity architecture dated August 8, 2021]] — The August 8, 2021 page is a cloud control-plane inventory: registrar/DNS, edge proxy, virtual servers, object/media delivery, identity-as-a-service, VPN, file storage, secure email, and owned domains. The emphatic Cloudflare API note points toward programmatic orchestration. This is the clearest notebook-wide architecture: **domain → DNS/edge → compute → media → authentication → secure transport → storage → mail**. - [[Scanned_20260730-1659#PDF page 66 — GoMcGill DNS addresses and GoDaddy support transfer|PDF page 66: GoMcGill DNS addresses and GoDaddy support transfer]] — The three addresses were Cloudflare anycast endpoints for `gomcgill.com` at the time written; Cloudflare’s proxy model intentionally returns Cloudflare addresses rather than the origin. The page’s “pings” are therefore evidence of edge routing, not direct evidence of where the origin server lived. The support-representative transfer records a human escalation layered onto the DNS investigation. Credential/PIN material remains redacted. ## Relationships and overlays The source places this record in an evidence cluster with [[Abstract Syntax Notation One|Abstract Syntax Notation One]] · [[Adobe Typekit|Adobe Typekit]] · [[Amazon S3 Dual-stack Endpoint|Amazon S3 Dual-stack Endpoint]] · [[Amazon Web Services|Amazon Web Services]] · [[Anycast|Anycast]] · [[AT&T|AT&T]] · [[Auth0|Auth0]] · [[Autonomous System Number|Autonomous System Number]] · [[BidSwitch|BidSwitch]] · [[Box|Box]] · [[CarMax|CarMax]] · [[Cloud API|Cloud API]] · [[Cloudflare|Cloudflare]] · [[Cloudinary|Cloudinary]] · [[Crazy Egg|Crazy Egg]] · [[Criteo|Criteo]] · [[DigitalOcean|DigitalOcean]] · [[DigitalOcean Spaces|DigitalOcean Spaces]]. The occurrence contributes to the notebook's larger model of [[Identity Continuity|identity continuity]], [[Device Sovereignty|device sovereignty]], and [[Continuity Architecture|continuity architecture]]. ## Evidentiary status and open leads Recover firewall rules and timestamps; distinguish ASN-level ownership from hostname-, certificate-, and process-level attribution. ## Source - [[Scanned_20260730-1659|Scanned_20260730-1659]]