| Actual infrastructure provider | Attribution cases where the underlying network and datacenter matter most | ASN, prefix, upstreams, WHOIS, and routing clues | Brand visibility may be weaker, so users may not recognize it immediately | Medium | Best as the underlying ownership conclusion |
| Brand or reseller | Buyers who need to understand seller responsibility, ticketing, and pricing boundaries | Control panel, support boundary, node explanation, and terms transparency | It may not control the underlying network, and incident explanations can be limited | Low-medium | Best for understanding the service boundary |
| Fronting platform, CDN, or managed layer | Cases where a website, CDN, or managed layer is visible first | Whether the visible layer is front-end or origin and whether the origin can be traced further | It is easy to mistake the front layer for the real provider | Low | Best as the fork point in the identification workflow |