| CDN and edge entry points | Users analyzing front-layer website delivery | Edge ASNs, caching or WAF context, and domain plus HTTP clues | It does not directly reveal real origin ownership | Medium | Best as the front-layer conclusion |
| Anycast public infrastructure | Users analyzing public DNS, security resolvers, and global-node samples | Multi-region advertisements, shifting geolocation, and classic shared-service roles | It is easy to misclassify as a proxy or ordinary web server | Low-medium | Best as the shared-edge sample |
| Ordinary origin networks | Users who need the real serving location or provider | Origin resolution, real hosting, and provider or seller boundaries | It can be hidden completely when CDN fronting exists | Medium | Best as the final target of attribution |