Physical Address: Data Point Intelligence Guide

A physical address is where the digital investigation touches the ground. It is also where thousands of shell companies quietly share a single letterbox.

Understanding the Physical Address as an intelligence artifact

A physical address is a structured location reference: premises identifier, thoroughfare, locality, administrative area, postal code and country. Formats vary widely by country, and the same location can be written many valid ways, which makes normalisation the first analytic task. An address represents a place, not a person or a company, and the relationship between address and entity is always mediated by a record, a lease, a filing or a delivery. Treating an address as an identity is the classic beginner error.

Analytically, distinguish a residential address from a registered office, a virtual office, a mail forwarding service, a co-working space or a corporate service provider address. The latter categories host large numbers of unrelated entities, which is why address-based clustering must be volume-aware. Geocoding introduces its own uncertainty, since a returned coordinate may reflect the street centroid, the postcode centroid or an interpolated point rather than the building.

Why it matters

Addresses connect entities that share nothing else. A registered office used by dozens of companies with the same directors is a strong network signal in corporate crime and sanctions evasion work. Addresses also anchor jurisdiction, determining which registry, regulator and court applies, and they support ground truth verification through imagery, land registry data and property records. In sanctions screening and due diligence, address matching is a required component of entity resolution.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Entity density at the address, where hundreds of registered companies indicate a formation agent or virtual office rather than a genuine premises.
• Address type classification distinguishing residential, commercial, industrial, mail forwarding and corporate service provider premises.
• Land registry or property records showing ownership, transfer dates, charges and, in some jurisdictions, beneficial owner detail.
• Co-location of officers and entities, where the same address recurs across otherwise unconnected filings and forms a network edge.
• Consistency between the claimed business activity and the physical reality visible in imagery, such as an industrial firm at a residential terrace.
• Historic occupancy from filings and directories, establishing when an entity was actually associated with the location.
• Postal validity and deliverability, where an address that fails official validation may be fabricated or deliberately obfuscated.
• Jurisdictional implications for regulator, court and registry, which follow directly from the administrative area and country.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• National postal address validation services, for example Royal Mail PAF or USPS — Authoritative deliverability and canonical formatting for addresses in that country.
• OpenCorporates — Companies and officers registered at an address, revealing entity density and shared corporate structures.
• National company registries such as Companies House — Registered office history, officer service addresses and filing dates for entities at the location.
• Land registry and cadastral services where public — Property ownership, title, transaction history and registered charges for the premises.
• OpenStreetMap and Nominatim — Open geocoding, building footprints and land use classification for validating what physically exists there.
• Open aerial and street-level imagery providers — Visual ground truth confirming premises type, signage and plausibility of claimed occupancy.
• OpenSanctions — Address attributes attached to sanctioned entities, supporting screening and network detection.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Normalise and validate — Parse into structured components, apply the country postal standard, and confirm deliverability before any matching or clustering.
2. Classify the premises — Determine whether it is residential, commercial, virtual office or agent address, since that decides how much weight any linkage can carry.
3. Measure entity density — Count registered entities and officers at the address, and downweight linkage proportionally when the count indicates a service provider.
4. Pull property records — Where public, retrieve ownership, transfer history and charges to establish who controls the premises rather than who merely files there.
5. Corroborate physically — Use imagery and mapping to check that the premises exist and match the claimed use, noting discrepancies as investigative leads.
6. Build the entity network — Link entities and officers sharing the address, filtering out shared-service noise, and test whether links hold on other attributes too.
7. Record provenance — Preserve the source record, retrieval date and exact string for every association, since addresses change and filings are periodically corrected.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Pivots to these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Email Address — Electronic mail address tied to an individual or organization.
• Username / Handle — Screen name or handle used across online platforms and services.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Device / Advertising ID — A mobile advertising or device identifier used in adtech data to track and locate devices.

Inside the platform: where Physical Address lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_address — Data point hub
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Normalise and validate is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Measure entity density turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Record provenance feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Physical Address

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Addresses appear in defence work through supply chain assurance, facility and infrastructure analysis, and personnel security. Establishing that a supplier's registered office is a virtual mailbox shared with hundreds of entities is a genuine procurement integrity finding, and address clustering exposes front company structures used in sanctions and export control evasion. Constraints are serious: residential addresses of individuals are among the most safety critical data an analyst handles, distinction obligations apply where a location is assessed, and geocoding uncertainty must be stated because a returned coordinate frequently reflects a street or postcode centroid rather than a building.

🕵 National intelligence

Address analysis supports entity resolution, procurement network mapping and sanctions evasion work, where shared registered offices, company formation agent addresses and shell clusters are among the most reliable structural signals available from open records. Registry, land and corporate sources are documentary and dated, which makes them suitable for releasable reporting. Handling is sensitive where an address is residential, since it identifies a person's home. Minimisation applies before dissemination, and any assessment that combines address with a named individual should be treated as identity reporting subject to the corresponding controls and retention limits.

👮 Law enforcement

For law enforcement addresses anchor jurisdiction, determine which registry and court apply, and support search warrant applications and asset tracing. Corporate registers, land registries, court filings and utility or tenancy records obtained under process provide the documentary chain. Address matching alone is weak evidence: virtual offices, formation agents and co-working spaces host thousands of unrelated entities, so density must be assessed before a shared address is treated as a link. Preserve registry extracts with retrieval timestamps, and route occupancy and tenancy data through production orders rather than commercial aggregators of uncertain provenance.

🔍 Private investigation and corporate security

Corporate investigators use addresses for due diligence, sanctions screening, fraud network detection and asset tracing, working from corporate registers, land records and published filings. Detecting that a counterparty shares a registered office with previously struck off entities is standard and defensible work. What a private actor may not do is conduct physical surveillance of a private residence, obtain occupancy or utility data without lawful authority, or publish a residential address. Deliverables should classify each address by type, quantify entity density, and clearly separate registered office findings from anything touching a person's home.

📰 Journalism and OSINT media

Addresses make corporate stories concrete: a company claiming a London headquarters that is a mailbox above a shop is a verifiable, publishable fact supported by registry extracts and imagery. Verification requires classifying the address type, checking how many entities are registered there, and corroborating with street level imagery and local records. The ethical line is residential: publishing a private individual's home address is effectively never justified and creates direct physical risk, and the same applies to details that allow readers to derive it. Give the entity a right of reply on the address findings before publication.

🌍 NGO, humanitarian and human rights

Human rights and anti corruption organisations use address clustering to expose shell company networks, sanctions evasion and illicit finance, all from documentary registry sources. Do no harm is decisive when an address relates to a person: publishing the home of an activist, a survivor or even an alleged perpetrator can endanger family members and is rarely proportionate. Where an address relates to a place of detention, a factory or an infrastructure site, documentation for accountability follows Berkeley Protocol practice with imagery corroboration and preserved provenance. Store any residential address encrypted and restricted, with a plan for office compromise.

🎓 University and research

Researchers use addresses for studies of corporate networks, illicit finance, urban geography and registry data quality. Normalisation is the central methodological problem, since the same location can be written many valid ways and matching error rates are high and under reported. Method should state the normalisation and geocoding services used and their versions, and report match confidence distributions rather than a single accuracy figure. Ethics review is required where residential addresses are processed, and publication should aggregate to postcode district or higher. Registry licences frequently restrict bulk redistribution, so check terms before sharing derived datasets.

Playbook: working Physical Address end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Record purpose, basis and sensitivity

Document why the address is being processed and set the sensitivity level immediately, distinguishing corporate registered offices from anything that may be a residence. Residential addresses attract the highest handling controls because disclosure enables physical harm. A good output is an authorisation with a sensitivity classification and access list. Stop if the purpose is to locate a private individual without a legitimate investigative mandate.

Phase 2 — Normalise to a structured form

Parse the address into components, premises identifier, thoroughfare, locality, administrative area, postal code and country, using country specific rules rather than a single template. Retain the original string verbatim alongside the parsed form. A good output is a structured record with the parser and reference data version noted. Stop when the same physical location written in several ways resolves to the same structured record in your test set.

Phase 3 — Validate against authoritative reference data

Check the address against the national postal or addressing authority dataset where one exists, which confirms the address is real and returns a canonical form and often a unique property reference. A good output is a validation verdict with the reference identifier where available. Stop when the address is confirmed, corrected or flagged as unverifiable, which is itself a finding for due diligence purposes.

Phase 4 — Classify the address type

Determine whether it is residential, a commercial premises, a registered office, a virtual office or mail forwarding service, a company formation agent, a co-working space or an accommodation address. This classification governs every subsequent inference and is the step most often skipped. A good output is a type with the evidence supporting it. Stop when the type is established, because clustering on an unclassified address is meaningless.

Phase 5 — Measure entity density

Count how many companies, officers and historic entities are registered at the address across the relevant registry, and compare against a baseline for the locality. A single terraced house with four hundred registered companies is a finding; a formation agent office with the same count is a background fact. A good output is a density figure with the comparison baseline. Stop when density is quantified rather than asserted.

Phase 6 — Build the entity network

Where density is anomalous for the address type, map the entities, their officers, incorporation and dissolution dates and any shared directors or secretaries. Look for temporal clustering, since front company networks are frequently incorporated in batches. A good output is a network with dated relationships and the registry extracts evidencing each. Stop when the network is bounded and every edge is documentary.

Phase 7 — Corroborate with property records

Where lawful and proportionate, check land registry, cadastral or property tax records for ownership, charges and transaction history, which convert an address into an asset with an owner. Licences frequently restrict reuse, so check terms. A good output is a property record extract with its retrieval date. Stop when ownership is established from an official record rather than inferred from occupancy.

Phase 8 — Geocode with explicit uncertainty

Convert to coordinates using a documented geocoder and record the match precision returned, distinguishing rooftop, parcel, street interpolation and postcode centroid results. Never present an interpolated or centroid result as a building location. A good output is a coordinate with a stated precision class. Stop when precision is recorded; a bare coordinate implies accuracy the geocoder did not claim.

Phase 9 — Verify against imagery

Compare the candidate location against aerial and street level imagery and open mapping data to confirm the premises type matches the claim, checking imagery dates because sites change. A residential terrace behind a claimed corporate headquarters is a direct, publishable contradiction. A good output is a visual verification note with imagery source and date. Stop when the premises type is either confirmed or contradicted.

Phase 10 — Check sanctions and enforcement linkage

Screen the address against sanctions designations, enforcement actions, insolvency records and disqualification registers, since designated addresses are published and reused across front company networks. A good output is a screening result with the list and version used. Stop when the screening is complete and any match is corroborated against the underlying designation record.

Phase 11 — Assess and constrain disclosure

Decide what will be reported and to whom, applying the rule that a private residential address is never published and is disclosed internally only to those who need it. For corporate addresses, ensure that a registered office which is also a director's home is treated as residential. A good output is a recorded disclosure decision. Stop when the decision explicitly addresses the residential question.

Phase 12 — Retain, restrict and review

Apply access controls, log access, honour registry licence conditions on reuse and redistribution, and set a retention period with a review date. Address data ages quickly and stale residential data carries risk without value. A good output is a controlled record with a deletion date and licence note. Stop when retention is scheduled and licence conditions are recorded.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Companies House and equivalent corporate registers	Open	Official registers holding registered office addresses, officer service addresses, incorporation dates and filing histories for companies.	Primary source for registered office data and for counting entities registered at an address.
OpenCorporates	Registration	Aggregated company registry data across many jurisdictions with entity, officer and address fields linked back to source registers.	Cross jurisdiction address clustering to find networks that a single national register would not reveal.
HM Land Registry and national cadastral services	Licensed	Official records of property ownership, title, charges and transaction history tied to defined land parcels.	Converts an address into an asset with a documented owner and transaction history for asset tracing.
Ordnance Survey and national addressing authorities	Licensed	Authoritative address and property reference datasets including unique property identifiers, classifications and coordinates.	Validates that an address exists, returns a canonical form and provides a stable property reference for matching.
Universal Postal Union addressing standards	Open	International reference material on national addressing formats, component ordering and postal code structures.	Supports correct country specific parsing rather than applying a single template that mangles non Western formats.
OpenStreetMap and Nominatim	Open	Open geographic database with building outlines, addresses and business names, plus an open geocoding service with precision indicators.	Open geocoding and premises verification with transparent match quality, suitable for reproducible research.
Copernicus and Sentinel imagery	Registration	European open satellite imagery programme with regularly refreshed optical and radar coverage and documented acquisition dates.	Independent, dated imagery for verifying site type and detecting change between reported and observed conditions.
Google Earth and commercial imagery archives	Registration	Historic and current aerial and street level imagery with capture dates covering much of the populated world.	Visual confirmation of premises type and historic state, which frequently contradicts claimed corporate presence.
OFAC and consolidated sanctions lists	Open	Sanctions designations including addresses of designated entities and individuals, with programme references and designation dates.	Screening addresses against designations and identifying reused front company addresses across networks.
OpenSanctions	Open	Consolidated open dataset of sanctions and politically exposed person records with normalised names, entities and addresses.	Single pass address screening across many regimes with structured, machine readable output.
The Gazette and official public notices	Open	Government published notices covering insolvency, strike off, appointments and other legally required publications with addresses.	Dated official record linking addresses to corporate events such as insolvency clusters at a single premises.
ICIJ Offshore Leaks database	Open	Searchable database of offshore entities, officers, intermediaries and their registered addresses derived from leaked records.	Identifies intermediary and agent addresses that recur across offshore structures, used as a lead requiring corroboration.
Global Legal Entity Identifier Foundation	Open	Open reference data linking legal entity identifiers to registered and headquarters addresses and parent relationships.	Authoritative structured address data for financial market participants and their corporate group structure.
FATF guidance on beneficial ownership	Open	International standards and guidance on transparency of legal persons including the role of nominee and agent addresses.	Frames why address clustering matters in illicit finance and what regulated entities are expected to detect.
Berkeley Protocol on Digital Open Source Investigations	Open	Methodological standard covering geolocation, verification, corroboration and preservation of open source material.	Framework for documenting geolocation reasoning and uncertainty so findings withstand later legal scrutiny.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Physical Address. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• libpostal — Statistical international address parser and normaliser handling many national formats. Limitation: probabilistic, so unusual formats and non Latin scripts produce parsing errors.
• Nominatim — Open geocoder returning coordinates with match type and precision indicators. Limitation: coverage and address completeness vary enormously by country and locality.
• QGIS — Plots addresses, parcels and imagery layers together for spatial verification and clustering. Limitation: visual plausibility is not evidence without a supporting record.
• Record linkage and fuzzy matching libraries — Match address variants across datasets with configurable comparison strategies. Limitation: error rates depend on parameters that are rarely reported or tuned.
• Corporate registry bulk data and APIs — Enable systematic counting of entities registered at an address rather than one lookup at a time. Limitation: licences frequently restrict bulk reuse and redistribution.
• Aleph by OCCRP — Cross references addresses across leaked and public document collections. Limitation: coverage is uneven and every match needs verification against a primary source.
• Imagery viewers with historic layers — Compare site appearance across dated captures to test claims about premises use. Limitation: capture frequency is poor outside major urban areas.
• Graph analysis platforms — Visualise entity, officer and address relationships to expose front company networks. Limitation: shared addresses at service providers create dense false clusters unless density is normalised.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Classify the address type before you cluster on it. Formation agents, virtual offices and co-working spaces legitimately host thousands of entities, and clustering without that context manufactures conspiracies out of ordinary business services.
• Density must be compared against a baseline for the address type and locality. Four hundred companies at an agent address is normal; four hundred at a residential terrace is the story.
• Temporal clustering beats raw counts. Front company networks are incorporated in batches over days or weeks, so the incorporation date distribution at an address is more diagnostic than the total number of entities.
• A registered office is frequently a director's home, particularly for small companies. Treat any registered office that matches a residential property record as residential for handling purposes regardless of how it is labelled.
• Record the geocoder precision class, never just the coordinate. Street interpolation and postcode centroid results are routinely presented as building locations, and the resulting error can be a hundred metres or an entire street.
• Check imagery capture dates before relying on what you see. A site can change use entirely between captures, and an outdated street level image is a common source of confidently wrong premises assessments.
• Registry licences bind you after the download. Many addressing and property datasets restrict bulk redistribution and derived product publication, and breaching those terms can cost your organisation access it depends on.
• Never publish a residential address, and check whether what you are publishing allows one to be derived. A photograph, a parcel reference or a precise coordinate can all reconstruct a home location as effectively as the address itself.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Physical Address is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of addresses in the case system stored in structured, validated form with a reference identifier where one exists.
• Match rate and confidence distribution of address normalisation against authoritative reference data, sampled for manual verification.
• Share of clustering findings where entity density was normalised against an address type baseline before any conclusion was drawn.
• Number of geocoded results reported with an explicit precision class rather than as a bare coordinate.
• Count of residential addresses held, tracked downward, with the proportion carrying a documented necessity justification.
• Rate at which corporate address findings were corroborated by imagery or a second documentary source before reporting.
• Registry licence compliance, measured as the proportion of derived datasets checked against source terms before sharing.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Company formation agents and virtual offices host thousands of unrelated entities, so shared address alone is weak and often meaningless evidence.
• Geocoding returns street or postcode centroids, so a plotted point may be tens or hundreds of metres from the actual building.
• Registered office addresses are frequently the accountant, not the business, and reveal nothing about where operations actually occur.
• Address formats differ so much internationally that naive string matching produces both duplicates and missed matches at high rates.
• Registry records are updated slowly and retain historic addresses, so current filings may describe a location long since vacated.
• Residential addresses expose households including children and unrelated occupants, creating serious harm potential if handled loosely.

Legal and ethical considerations

A residential address is personal data and among the most safety-critical attributes an analyst handles, because disclosure can enable stalking, harassment or violence. Process only with a documented lawful basis and clear necessity, restrict access to the case team, and never publish a private residential address. Corporate registered addresses carry far lower sensitivity but can still be a director's home. Apply retention limits, log access, and be aware that many registries impose licence terms restricting reuse and bulk redistribution of address data.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Physical Address, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Hundreds of companies share this address. Is that suspicious?

Only after you classify the address. Company formation agents, virtual office providers, accountancy practices and co-working spaces legitimately act as registered office for very large numbers of unrelated entities, and this is an ordinary commercial service in most jurisdictions. The finding becomes significant when the density is anomalous for the premises type, for example a residential property or a small retail unit, or when the entities cluster tightly in incorporation date, share officers, or connect to enforcement actions. Establish the type and the baseline first, then assess.

How accurate is geocoding?

It depends entirely on the match type, which is why recording it matters more than recording the coordinate. Rooftop or parcel matches are typically accurate to the building. Street interpolation estimates a position along a road segment and can be off by tens of metres or land on the wrong side. Postcode or locality centroid results are not building locations at all and can be hundreds of metres out, or in rural areas considerably more. Never present a centroid as a premises location, and always report the precision class alongside the coordinate.

Can I use property records to identify who lives somewhere?

Land registries record legal ownership, not occupancy, and the two frequently differ. Ownership records are documentary and usable for asset tracing under a lawful basis, subject to registry licence conditions. Occupancy is a different question answered by tenancy, utility or electoral records, which are generally restricted and require lawful authority to obtain. For private actors there is usually no lawful route to occupancy data, and pretexting a utility or landlord to obtain it is unlawful in most jurisdictions and will destroy the investigation.

What is the safest way to handle a residential address?

Treat it as the highest sensitivity item in the record. Restrict access to the specific individuals who need it for the defined purpose, log access, never include it in circulated products or presentations, and set a short retention period with active deletion. Where the address appears as a company registered office, apply the same controls rather than the lower corporate standard. In publication, do not include the address, images that identify the property, precise coordinates or parcel references, since any of these reconstructs the location.

How do I match addresses written differently?

Parse into components using country specific rules rather than a single template, normalise abbreviations and ordering, then match on the structured fields with tolerance for the components that vary most. Where an authoritative addressing dataset exists, resolve both variants to its canonical form and unique property reference, which removes the matching problem entirely. Report match confidence rather than treating matching as binary, and manually review a sample, because address matching error rates are high and systematically under reported in automated pipelines.

Does a shared address prove a connection between companies?

It establishes a link worth investigating, not a relationship. Shared registered offices at service providers connect nothing. Shared addresses at unusual premises, combined with overlapping officers, temporally clustered incorporation, common filing agents and correlated bank or trading patterns, build a genuine network case. The discipline is to treat the address as one edge in a graph and require at least one further independent edge before asserting a relationship, then report the specific evidence for each connection rather than the graph as a whole.

What should I check before publishing an address finding?

Four things. Whether the address is or could be residential, including a director's home used as a registered office. Whether the classification and entity density were established against a baseline rather than asserted. Whether imagery or a second documentary source corroborates the premises type, and whether the imagery is current. And whether the entity has been given a genuine opportunity to respond to the specific finding. Additionally check registry licence terms, since some datasets restrict republication of address level detail even where the source is public.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• Universal Postal Union addressing standards, defining international address structure and national format variation.
• ISO 19160 addressing standards, providing a conceptual model for address data and its exchange between systems.
• National addressing authority specifications such as the unique property reference number scheme, defining canonical identifiers for premises.
• FATF Recommendations 24 and 25 on transparency of legal persons and arrangements, which frame address clustering in beneficial ownership analysis.
• GDPR Articles 5, 6 and 9 with equivalent national law, governing lawful basis, minimisation and retention for residential address data.
• Registry licensing terms for corporate, land and addressing datasets, which bind reuse, redistribution and derived product publication.
• Berkeley Protocol on Digital Open Source Investigations, setting geolocation, corroboration and uncertainty reporting standards.
• ISO/IEC 27701 privacy information management, providing controls for processing personally identifiable information including home addresses.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Companies House register — UK Government. Official register of companies including registered office and officer service addresses.
2. OpenCorporates — OpenCorporates. Aggregated open company registry data supporting cross jurisdiction address analysis.
3. OpenStreetMap — OpenStreetMap Foundation. Open geographic database with addresses, buildings and business names used for verification and geocoding.
4. Ordnance Survey addressing products — Ordnance Survey. Authoritative addressing and property reference datasets for Great Britain.
5. Universal Postal Union addressing resources — UPU. International reference material on national addressing formats and standards.
6. Copernicus programme — European Union. Open satellite imagery programme providing dated earth observation data for site verification.
7. OFAC sanctions programmes — US Department of the Treasury. Sanctions designations including addresses used by designated entities and individuals.
8. Offshore Leaks Database — ICIJ. Database of offshore entities and their registered and intermediary addresses.
9. FATF Recommendations — Financial Action Task Force. International standards on beneficial ownership transparency and legal person misuse.
10. Berkeley Protocol on Digital Open Source Investigations — UN OHCHR. Standard for geolocation methodology, corroboration and uncertainty reporting.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: normalises and classifies addresses, scores entity density and maps registry-evidenced links without exposing private residential detail. Explore the platform, or browse the rest of the library by following any tag above.