Unknown

OPINION

Roderick Vosburgh appeals his conviction for possession of child pornography in violation of 18 U.S.C. § 2252(a)(4)(B) and attempted possession of child pornography in violation of 18 U.S.C. § 2252(b)(2). We will affirm.

I. Factual Background

A. Ranchi

At the center of this case is an underground Internet message board known as Ranchi. Ranchi allows users to post links to images and videos of child pornography.1 Ranchi is not simply an open forum in which some posts happen to be related to child pornography; child pornography is Ranchi’s raison d’etre. It describes itself as a place to “share all kinds of material especially for all the kiddy lovers around the world. This material can range from non-nude cutíes to hard core baby material.” Ranchi allows its users access to a wide range of pornographic pictures and videos, including hard core videos of infants and other children engaging in sexual acts with each other and with adults. Ranchi explicitly warns that the pornographic materials posted to the board are illegal.

Ranchi does not itself host child pornography; instead, it directs users to where it *517can be found elsewhere on the Internet. For obvious reasons, chiefly among them a desire to evade law enforcement, Ranchi operates in the far recesses of cyberspace. It is accessible through the use of any one of three “gateway” websites that exist at any given time. Each gateway consists of a web page that contains nothing but a hyperlink to the actual Ranchi message board. The gateway sites change approximately every three months, but regardless of their location, they always point to the most recent location of the Ranchi board, which itself moves around the Internet on a weekly basis. It is highly unlikely that an innocent user of the Internet would stumble across Ranchi through an unfortunate Google search. Because Ranchi moves so frequently and has cumbersome URLs, it is most often, if not always, accessed by way of the gateway sites. Interested persons often learn of Ranchi, and where to find the gateways, through postings on other child pornography websites.

A user seeking to access a link to child pornography posted on Ranchi cannot do so with a simple click of the mouse. It requires several steps. URLs as posted by Ranchi users typically begin with the prefix “hxxp,” rather than the customary “http,” to make it less likely that the links will be detected by search engines. Therefore, a user interested in that link must copy it from the board, paste it into the address bar of a web browser, and then change “hxxp” to “http” so that the address will be recognized by the browser. Only then can the file be accessed and downloaded. Even after downloading, files cannot be viewed immediately. They first must be decrypted, in part through use of a password.

in July 2006, FBI Special Agent Wade Luders learned of Ranchi’s existence from a suspect apprehended in an investigation of a different child pornography board. That suspect authorized Luders to use his Ranchi handle, “Bongzilla,” to go undercover on the board. On October 25, 2006, Luders posted six links to what purported to be child pornography. One of those links directed users to a video located at the following address: hxxp://uploader. sytes.net/12/05/4yo_suck.rar.html. Along with this link, Luders posted the following description:

[H]ere is one of my favs — 4yo he with dad (toddler, some oral, some anal)— supercute! Haven’t seen her on the board before — if anyone has anymore, PLEASE POST.

In the parlance of Ranchi, “yo” stood for “year old” and “he” stood for “hard core.”2 Luders quickly realized that because he had mistakenly failed to encrypt the file, it was unlikely to attract attention. He then re-posted the “4yo_suck” link and posted instructions for decrypting the file. He also promised to post the necessary password, but never did.

The “4yo_suek” link (hereinafter the “Link”) was, in short, a trap. It did not direct the user to actual child pornography. It was a dummy link which led only to Agent Luders’s secure FBI computer. The “video” downloaded by way of the Link generated only gibberish on the recipient’s computer screen. Meanwhile, Agent Luders’s computer generated a log file containing the Internet Protocol addresses (“IP addresses”)3 of every user who attempted to access the Link, and the date and time of each attempt. Among *518those who attempted to access the Link was a user at the IP address 69.136.100.151. That individual attempted to download the Link three times in a two-minute period between 11:46 and 11:48 p.m. EST on October 25, 2006. Luders traced this IP address to Comcast Cable Communications. In response to a subpoena, Comcast informed the government that “the individual utilizing the IP address 69.136.100.151 on October 25, 2006 at [the relevant times] did so using an account subscribed to by Rod Vosburgh, residing at 37 State Rd., Apt. B4” in Media, Pennsylvania. Luders forwarded this information to FBI Special Agent David Desy in Philadelphia.

B. Affidavit and Search Warrant

Agent Desy took steps to confirm that Vosburgh lived at the address identified by Comcast, and that he lived there alone. A January 17, 2007, search of Pennsylvania Bureau of Motor Vehicle records confirmed that Vosburgh resided at 37 State Road, Apartment B4 in Media, and a Choicepoint query conducted the same day revealed the same information. On January 31, 2007, through query of the U.S. Postal Service, Agent Desy learned that Vosburgh was the only person receiving mail at the apartment in question. In addition, Agent Desy twice conducted surveillance of the apartments at 37 State Road, and both times observed a vehicle in the parking lot matching the description of the one owned by Vosburgh.

On February 23, 2007, Agent Desy applied for a warrant to search Vosburgh’s apartment. The affidavit in support of that application described how computers and the Internet have facilitated the spread of child pornography. It explained what IP addresses are, and how “[l]aw enforcement entities, in conjunction with Internet Service Providers, have the ability to identify a user’s IP address to a specific household or residence.” It also described certain characteristics and habits of persons interested in child pornography. It noted that “[c]hild pornography collectors almost always maintain and possess their material in the privacy and security of their homes, or some other secure location such as their vehicle(s), where it is readily available,” and that collectors tend to hoard their materials:

Because the collection reveals the otherwise private sexual desires and intent of the collector and represents his most cherished sexual fantasies, the collector rarely, if ever, disposes of the collection. The collection may be culled and refined over time, but the size of the collection tends to increase.

The affidavit also noted that even if a collector deletes illegal materials from his computer’s hard drive, law enforcement can often retrieve those files using forensic tools. Next, the affidavit described the nature of Ranchi, with graphic descriptions of some of the illegal pornographic materials that agents had found posted to the site. It then summarized Agent Luders’s posting of the Link, how his computer logged the IP addresses of users who attempted to access the Link, and why it was unlikely that anyone who attempted to download the video promised by the Link would have done so by accident.4 Finally, the affidavit laid out the facts specific to Vosburgh. It noted that an individual us*519ing the IP address 69.136.100.151 attempted to access the Link three times on the night of October 25, 2006. It recounted how Agent Desy traced that IP address back to Vosburgh’s apartment, and the subsequent steps Agent Desy took to confirm that Vosburgh actually lived there. It also described in detail the property to be searched and the items to be searched and seized. Those items included “[a]ny and all items which may be used to visually depict child pornography, store information pertaining to the sexual interest in child pornography, or to distribute, possess, or receive child pornography, ... including ... computer hardware!.]”

Magistrate Judge Felipe Restrepo issued a search warrant on February 23, 2007, approximately four months after Vosburgh’s apparent attempts to access the Link. That warrant was executed on February 27, 2007. Before they arrived at his apartment, officers learned that Vosburgh lawfully owned more than a dozen guns. Concerned for their safety, officers attempted to lure Vosburgh out of his apartment with a ruse. They knocked on his door, identified themselves as police, and told him that they wanted to talk to him because his car had been vandalized. Vosburgh did not answer the door, but from the apartment came a sound of “metal on metal” that sounded like the racking of a gun. Alarmed, officers remained outside of the apartment and attempted to persuade Vosburgh to open the door. They knocked at least three times, with the knocks getting louder each time. They also called Vosburgh’s telephone several times and left messages asking him to come out of the apartment. Approximately 27 minutes after officers first knocked, Vosburgh opened the door. He told officers that he did not answer sooner because he had been in the bathroom.

Inside Vosburgh’s apartment, police found pieces of smashed thumb drives, one of which was floating in the toilet. They also found a hammer and a pair of scissors outside of the bathroom door.5 They found a screwdriver next to a computer tower in the kitchen. The computer’s panel had been forcibly removed and its internal hard drive was missing. Part of an internal drive was found in a trash bag in the kitchen, and the remains of that same hard drive were found on a bookshelf in the living room. The destroyed internal hard drive was compatible with the tower in the kitchen.

In an interview with Agent Desy, Vosburgh acknowledged that he lived alone in the apartment and that he owned a computer. He denied intentionally breaking or destroying the computer’s internal hard drive; he claimed that he had discarded it two or three weeks earlier because it was corrupted. He told officers that he owned an external hard drive that contained adult pornography, and a thumb drive that contained work documents and more adult pornography. Officers collected the internal hard drive and the pieces of the thumb drive, but the FBI’s computer forensics experts were unable to recover anything from either. They also took the external hard drive, which was intact and later examined by FBI forensics expert Justin Price.6

*520C. Contents of the External Hard Drive

The external hard drive contained a folder with hundreds of pictures of what the government calls “child erotica.”7 Many of these were pictures of a young Asian girl known as Loli-chan who has gained some notoriety by posting suggestive photos of herself on the Internet.8 It also contained a folder called “jap 111.” This folder contained twenty pictures of adult women in .jpeg format9 and a file called thumbs.db which itself contained 68 ‘thumbnail’ images. Two of those images were of child pornography. One depicted a naked prepubescent girl in the computer room of a house, with one leg propped up unnaturally to expose her genitalia. This image became Government Exhibit 14 at trial, and we will refer to it as such. The second depicted four naked young girls, sitting on a couch with their legs spread to expose their genitalia. This became Government Exhibit 15.

Notably, these two images did not exist as full-sized, independent picture files (such as .jpeg files) in the japlll folder when the government seized the hard drive. Nor were full-sized .jpegs of those images recovered anywhere else on the external hard drive. Rather, they existed only as miniatures within the thumbs.db file in the japlll folder. Because the nature of thumbs.db is critical to resolution of the issues raised in this appeal, it is necessary to recount the record evidence concerning this file.

On ordinary computers running Windows operating systems, picture files are often stored in folders. When a folder is opened, the user has several options for displaying the pictures contained therein. One option is the “thumbnail” view. When the user selects the thumbnail view, a miniature version of each picture in the folder is displayed. Each of those miniatures is called a “thumbnail.” The user can click on the thumbnail to open it and view a full-sized version of the picture. When the user selects the thumbnail viewing option, the Windows operating system automatically creates a hidden system file called *521“thumbs.db” within that folder. The user need not instruct Windows to do so; it happens automatically as part of the process of viewing the contents of the folder in thumbnail view. Thumbs.db is not a collection of many image files; it is a single file, which can be thought of as a visual catalog of all the image files contained in the folder. It contains a miniature, degraded version of every image in the folder that has been converted into a thumbnail pursuant to the use of the thumbnail view.

The thumbs.db file is stored within the folder whose content it reflects, along with the picture files themselves. But the ordinary user cannot view the contents of thumbs.db. Indeed, the ordinary user does not even know that thumbs.db is there. At trial, the government’s expert Justin Price confirmed that opening the thumbs.db file to view its contents requires special software, and that there was no evidence that Vosburgh possessed such software or was otherwise capable of viewing the contents of the thumbs.db file in the japlll folder.

The significance of the presence of Exhibits 14 and 15 in the thumbs.db file on Vosburgh’s external hard drive was one of the central factual issues at trial. The government contended that the existence of Exhibits 14 and 15 in the thumbs.db file was evidence that corresponding full-sized picture files once existed on Vosburgh’s hard drive in the japlll folder. According to the government, Vosburgh knowingly possessed such pictures but then deleted them at some point before the search of his apartment on February 27; this explained why the hard drive contained thumbs.db versions of Exhibits 14 and 15, but not full-sized .jpeg versions of those same images. We will refer to this theory throughout our opinion as the government’s “prior possession” theory.

Vosburgh vigorously contested the prior possession theory. He contended at trial, and now contends on appeal, that he conclusively disproved the theory with an in-court demonstration by his expert, Dr. Rebecca Mercuri. He also offered several alternative explanations for the presence of Exhibits 14 and 15 in the japlll thumbs.db file.

II. Procedural History

A. The Indictment

On June 5, 2007, a grand jury in the Eastern District of Pennsylvania returned a four-count superseding indictment against Vosburgh. Count I charged that Vosburgh “knowingly possessed one external hard drive that contained visual depictions” of child pornography, in violation of 18 U.S.C. § 2252(a)(4)(B), “on or about February 27, 2007.” This charge related to his possession of the hard drive containing the images that became Exhibits 14 and 15. Count II charged Vosburgh with attempted possession of child pornography in violation of 18 U.S.C. § 2252(b)(2), in connection with Vosburgh’s attempts to access the Link. Count III charged that Vosburgh knowingly altered or destroyed tangible objects with the intent to obstruct the investigation of a matter within the jurisdiction of the FBI, in violation of 18 U.S.C. § 1519. Count IV charged Vosburgh with violating 18 U.S.C. § 2232 by knowingly destroying property in order to prevent its lawful seizure by the government.

B. Pre-Trial Proceedings

Considerable motion practice preceded Vosburgh’s trial. Three sets of motions are most relevant to this appeal. First, Vosburgh and the government filed motions in limine. The government sought to admit much of the child erotica found on the external hard drive; Vosburgh sought *522to exclude it. The government argued that those materials, while not illegal, were relevant because they suggested that Vosburgh had a sexual interest in children and tended to disprove that Vosburgh did not know that he possessed the pornographic pictures in Exhibits 14 and 15. It further argued that the images were admissible under Rule 404(b) because possession of those materials helped to show Vosburgh’s intent to possess child pornography. Vosburgh argued that the District Court should exclude the child erotica as unduly prejudicial under Rule 403. Ultimately, the District Court admitted some but not all of this evidence. It allowed forty-six non-pornographic images of prepubescent girls in swimsuits and thirty of the Lolichan pictures.

Second, on June 19, 2007, Vosburgh filed a request for a bill of particulars. He demanded that the government specify, inter alia, the time and date that he allegedly “downloaded the two visual depictions” which formed the basis for Count I. The government opposed Vosburgh’s request on the ground that Vosburgh already knew everything he was entitled to know:

[T]he defendant has been provided with substantial discovery, including reports of interviews of witnesses, four search warrant affidavits, grand jury testimony, police reports, documents, and reports of forensic examinations of the computer equipment. Moreover, defendant has had access to and reviewed the evidence (including images and documents on the external hard drive) that was seized from his residence. Additionally, because the case originated by complaint and warrant, defendant was informed, in detailed fashion, of the basis of the underlying charges as set forth in the affidavit. The defendant even took the opportunity to cross-examine the case agent at his probable cause hearing. And, finally, after the Superseding Indictment, government counsel identified for defense counsel the two images found on defendant’s external hard drive that comprise the charges for the possession of child pornography.

Nevertheless, the government gave a few specific responses to the inquiries raised in Vosburgh’s request. In light of those responses, the District Court denied Vosburgh’s request for a bill of particulars as moot.

Third, Vosburgh moved to suppress the external hard drive and other evidence seized in his apartment, claiming that the warrant was not supported by probable cause. After a hearing, the District Court denied Vosburgh’s motion to suppress the fruits of the search, concluding that the magistrate “had a substantial basis for finding probable cause that there would be child pornography related evidence in the apartment described in the warrant.”10

C. Trial

Trial began on October 31, 2007 and lasted for four days. The relevant testimony is summarized below.

1. Agents Luders and Desy

Agents Luders and Desy testified about the events that led to Vosburgh’s arrest. Agent Luders testified to his three-and-a-half years of experience investigating child pornography crimes with the FBI. He described his investigations of Ranchi and similar websites, and the nature of the child pornography accessible through Ran-chi. He described how he posted the *523Link, how his computer logged Vosburgh’s IP address, and how he traced that IP address to Vosburgh. He also testified about the measures Ranchi has taken to conceal itself from all but the most dogged pursuers of child pornography, and why it was unlikely that anyone would have stumbled across the board accidentally. Finally, he testified to the steps users had to go through in order to access materials posted to the board, and why it was unlikely that anyone who had undertaken each of those steps would have done so inadvertently.

Agent Desy testified about the steps he took once he received the lead about Vosburgh from Agent Luders. He described how he confirmed where Vosburgh lived and the process by which he obtained the search warrant for Vosburgh’s apartment.

2. Comcast

A witness from Comcast testified about IP addresses and the process by which Comcast responds to requests from law enforcement to match IP addresses to individual Comcast subscribers. He explained that Comcast’s automated system assigns a unique IP number to each customer on a dynamic basis, and that the “lease period” for each IP address is approximately 6-8 days. At the expiration of that lease period, the assignment of an address to a particular computer may or may not be renewed. He further explained that Comcast can trace an IP address back to a particular customer’s account, through IP assignment logs that go back 180 days. Finally, he testified that between October 20 and October 30 of 2006, IP address 69.136.100.151 was assigned to an account registered to Vosburgh at 37 State Road, Apartment B4 in Media.

3. Justin Price

Price, an information technology specialist for the FBI, was the government’s expert witness. He conducted the forensic examination of Vosburgh’s external hard drive. He testified in support of the prior possession theory. According to Price, the fact that the thumbs.db images of Exhibits 14 and 15 existed in the japlll folder was proof that corresponding, full-sized originals must have also existed within that folder and on Vosburgh’s hard drive. He testified that the thumbs.db file containing Exhibits 14 and 15 was created on February 21, 2007, and that those specific images were added to (or modified within) thumbs.db on February 22 — meaning that “on February 22, basically the user went into the [japlll] folder ... clicked on view and showed these pictures in thumbnail view.” While Price testified that the presence of an image in the thumbs.db was definitive proof that the original, full-sized version of that image existed in the folder at one time, he also admitted on cross-examination that the presence of a picture within a folder did not necessarily mean that the image was actually viewed by the user. It meant only that the picture was present in a folder that was viewed in the thumbnail view.

4. Thomas Clinton

Retired U.S. Postal Inspector Thomas Clinton testified about the naked female in Exhibit 14. He explained that for the last 18 years of his career, he led a task force of agents investigating the transmission, production, and distribution of child pornography throughout the country. He testified that he recognized the female in Exhibit 14 because he had been in her home in New Kensington, Pennsylvania in 2003, during the execution of a search warrant. According to Clinton, she was a young girl who was living with her adoptive father at that time. Clinton testified that after the search of the house, the father was arrested and the girl was taken into protective custody. Over Vosburgh’s hearsay objection, Clinton also testified *524that he knew the girl’s date of birth to be August 25, 1992. On cross-examination, Clinton confirmed that he was not present when the photograph that became Exhibit 14 was taken, but reiterated that he recognized the girl in the picture and that she was less than 11 years old when he met her in New Kensington.

5. Dr. Rebecca Mercuri

Mercuri was Vosburgh’s forensic computer expert, and her testimony formed the bulk of Vosburgh’s defense. Mercuri had conducted her own forensic examination of the external hard drive. In her pre-trial expert report, she concluded that “there is absolutely no evidence that the [images in Exhibits 14 and 15] ... ever existed as individual .jpeg files at any time on [Vosburgh’s] hard drive.” At trial, she likewise fiercely disputed the prior possession theory. According to Mercuri, the fact that a thumbs.db file containing Exhibits 14 and 15 appeared in the jap 111 folder was not proof that full-sized .jpegs of Exhibits 14 and 15 once existed on the hard drive. To underscore that point, Mercuri conducted a live, in-court demonstration using two computers. Mercuri created a folder with four .jpegs depicting natural scenery: Pond, Blue Hill, Sunset, and Winter. She opened the folder and selected the thumbnail view, thus creating within that folder a thumbs.db file containing all four images. She then deleted Blue Hills and Winter from the folder, leaving only the Pond and Sunset .jpegs. Next, she copied the entire folder onto a second computer. When she opened that folder on the second computer, it contained only the Pond and Sunset .jpegs, but it also contained the thumbs.db file created on the first computer. Using special software to view the contents of thumbs.db on the second computer, she showed that this thumbs.db file contained four thumbnails, one corresponding to each of the .jpegs that originally existed in the folder. The point of her demonstration, Mercuri said, was to show that “you can have a thumbs.db file that contains thumbnails in it that you never had the original pictures of.”

Consistent with her demonstration, Mercuri offered her own theory about how the thumbs.db file containing the pornographic images could have gotten onto Vosburgh’s hard drive without the corresponding .jpegs for those pictures doing the same. According to Mercuri, Vosburgh could have gotten the thumbs.db images but not the corresponding originals if he had downloaded the japlll folder after the thumbs.db file was created in that folder but also after the full-sized versions of Exhibits 14 and 15 had been deleted.

With respect to Count II, Mercuri offered several theories as to how Vosburgh’s IP address could appear to have attempted to access the Link without Vosburgh himself knowingly doing so. Mercuri speculated that an unknown user could have “spoofed” Vosburgh’s IP address, or that Vosburgh’s computer could have been infected with malicious software that turned it into a “zombie.”11 She ad*525mitted, however, that -she had no evidence that such mischief had actually occurred.

6. Closing Argument

The government pressed the prior possession theory throughout its closing argument. For example, the prosecutor told the jury:

[Vosburgh] viewed [the pictures] on February 22nd. That is what the forensics showed. He viewed them on February 22nd. He went to his view options .... he chose view. In order to choose view, it has to be there and he viewed them. And when he viewed them, it automatically created a thumbnail. And he did this on February 22, 2007. And in order to do this, you have to have the original photos. You have to have the original photos in japlll before they could be viewed in thumbnail.

In response, Vosburgh emphasized Mercuri’s testimony that the existence of Exhibits 14 and 15 in the thumbs.db file did not prove that Vosburgh ever knowingly possessed the full-sized originals on his hard drive. He also reiterated his spoofing and zombie theories for why someone using his IP address appeared to have accessed the Link.

The jury found Vosburgh guilty on Counts I and II, and acquitted him on Count III.12 Vosburgh was sentenced to 15 months of imprisonment and three years of supervised release.

D. Post-Trial

Vosburgh filed a post-trial motion for judgment of acquittal, or in the alternative, for a new trial. He claimed that there was insufficient evidence to convict him on Counts I and II. He also claimed, for the first time, that a new trial should be held because there was a constructive amendment of his indictment and/or a variance between the indictment and the evidence at trial. The District Court denied Vosburgh’s motion without opinion.

Vosburgh then filed a timely notice of appeal. We have jurisdiction under 28 U.S.C. § 1291 and 18 U.S.C. § 3742(a). Vosburgh raises four challenges to his conviction. First, he contends that the District Court erred by failing to suppress evidence found in his apartment, because there was no probable cause to search his apartment for evidence of child pornography crimes. Second, he argues that the government constructively amended Count I of the indictment by changing its theory of prosecution during closing argument. In the alternative, he argues that there was a prejudicial variance requiring a new trial. Third, he argues that there was insufficient evidence to convict him on Count I. Fourth, he argues that the District Court erred at trial by admitting evidence that he contends was unduly prejudicial and inadmissible hearsay.

III. Probable Cause

The Fourth Amendment to the United States Constitution protects the “right of the people to be secure” in their homes and effects. U.S. Const, amend. IV. To that end, it generally requires that search warrants be supported by probable cause. Id. Evidence seized pursuant to a search warrant that is not so supported may be suppressed. See, e.g., United States v. Zimmerman, 277 F.3d 426, 438 (3d Cir.2002). Vosburgh argues that the District Court should have granted his motion to suppress because officers lacked probable cause to search his apartment.

*526A. Standard of Review

The applicable standards for issuing and reviewing a search warrant were set forth in Illinois v. Gates, 462 U.S. 213, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983):

The task of the issuing magistrate is simply to make a practical, commonsense decision whether, given all the circumstances set forth in the affidavit before him, ... there is a fair probability that contraband or evidence of a crime will be found in a particular place. And the duty of a reviewing court is simply to ensure that the magistrate had a “substantial basis for ... concluding]” that probable cause existed.

Id. at 238-39, 103 S.Ct. 2317 (some alterations in original).

We exercise plenary review of the District Court’s denial of a motion to suppress. Zimmerman, 277 F.3d at 432. “Thus, we apply the same standard the District Court was required to apply,” i.e., “whether the magistrate who issued the warrant had a ‘substantial basis’ for determining that probable cause existed.” Id. We owe “great deference” to the magistrate’s probable cause determination, Gates, 462 U.S. at 236, 103 S.Ct. 2317, but we will not simply “rubber stamp” it. Zimmerman, 277 F.3d at 432.

B. Analysis

Agent Desy’s affidavit explained that on October 25, 2006, someone using a computer with an IP address of 69.136.100.151 attempted to download a video that purported to be hardcore child pornography. It further explained that on the day in question, the relevant IP address was assigned to a Comcast account registered to Vosburgh’s apartment. It also asserted that child pornography collectors tend to hoard their materials and “rarely, if ever” dispose of them. We must decide whether these averments provided a “substantial basis” for the magistrate’s conclusion that there was a “fair probability that contraband or evidence of a crime [would] be found” in Vosburgh’s apartment at the time of the search. Gates, 462 U.S. at 238, 103 S.Ct. 2317. We answer that question in the affirmative.

This Court has not squarely addressed the issue, but several Courts of Appeals have held that evidence that the user of a computer employing a particular IP address possessed or transmitted child pornography can support a search warrant for the physical premises linked to that IP address. See, e.g., United States v. Perez, 484 F.3d 735 (5th Cir.2007).13 In Perez, a woman contacted law enforcement after she received an unsolicited email containing child pornography from a Yahoo! email address. Yahoo! identified the user who sent the offensive email, and from its records identified that user’s IP address. The FBI determined that the IP address belonged to a Time Warner customer, and subpoenaed the identity and address of that customer from Time Warner. A search of that address uncovered child pornography. Id. at 738. On appeal, the defendant argued that the images should have been suppressed because the “mere *527association between an IP address and a physical address is insufficient to establish probable cause.” Id. at 739. The Fifth Circuit disagreed, concluding that the IP address provided “a substantial basis to conclude that evidence of criminal activity” would be found at the defendant’s home, even if it did not conclusively link the pornography to the residence. Id. at 740. The court noted that although it was technically possible that the offending emails “originated outside of the residence to which the IP address was assigned, it remained likely that the source of the transmissions was inside that residence.” Id. (emphasis added).

We agree with the reasoning in Perez. As many courts have recognized, IP addresses are fairly “unique” identifiers.14 See, e.g., United States v. Forrester, 512 F.3d 500, 510 n. 5 (9th Cir.2008) (stating that “every computer or server connected to the Internet has a unique IP address”); Perrine, 518 F.3d at 1199 n. 2 (noting that an IP address “is unique to a specific computer”); Peterson v. Nat’l Telecomm. & Inform. Admin., 478 F.3d 626, 629 (4th Cir.2007) (explaining that “[e]ach computer connected to the Internet is assigned a unique numerical [IP] address”); White Buffalo Ventures, LLC v. Univ. of Texas at Austin, 420 F.3d 366, 370 n. 6 (5th Cir.2005) (describing an IP address as “a unique 32-bit numeric address” that essentially “identifies a single computer”). The unique nature of the IP address assigned to Vosburgh on October 25 made his attempts to access the Link fairly traceable to his Comcast account and the physical address to which that account was registered.

Attempted possession of child pornography is a federal crime. See 18 U.S.C. § 2252(b)(2). Therefore, the attempts to access the Link by someone using Vosburgh’s IP address were undoubtedly criminal activity. Considering the “totality of the circumstances” outlined in Agent Desy’s affidavit, Gates, 462 U .S. at 238, 103 S.Ct. 2317, we think it was fairly probable that “instrumentalities or evidence” of that criminal activity — -such as computers and computer equipment — -would be found in Vosburgh’s apartment.15 See United States v. Urban, 404 F.3d 754, 774 (3d Cir.2005) (quoting United States v. Tehfe, 722 F.2d 1114, 1117-18 (3d Cir.1983)); see also Agnellino v. New Jersey, 493 F.2d 714, 727 (3d Cir.1974) (stating that the standard for probable cause “clearly is something less than ‘certainty’ or ‘evidence of guilt beyond a reasonable doubt’ ”); Perez, 484 F.3d at 740 (recognizing that “[p]robable cause does not require proof beyond a reasonable doubt”).

Vosburgh argues that even if the IP address established some connection to the *528physical location of his apartment, the four-month gap between the warrant application and the attempts to access the Link described in Agent Desy’s affidavit rendered the information in the affidavit stale. The “[a]ge of the information supporting a warrant application is a factor in determining probable cause.” United States v. Harvey, 2 F.3d 1318, 1322 (3d Cir.1993). “If too old, the information is stale, and probable cause may no longer exist.” Zimmerman, 277 F.3d at 434. “Age alone,” however, is not determinative. Id. To analyze a claim of staleness, we must do more than simply count the number of the days between the date of the alleged criminal activity and the date of the warrant. We must also consider “the nature of the crime and the type of evidence” involved. Id.

This is not the first time we have had occasion to consider staleness vel non in the context of child pornography. See, e.g., United States v. Shields, 458 F.3d 269, 279 n. 7 (3d Cir.2006); Harvey, 2 F.3d at 1322-23 (rejecting defendant’s staleness claim). In Shields, FBI agents infiltrated two online groups explicitly dedicated to the exchange of child pornography. Eventually, both groups were shut down and the agents obtained records of group members’ email addresses. Shields, 458 F.3d at 272. They traced one of those addresses back to Shields. Nine months after the groups were shut down, agents obtained a search warrant for Shields’s home, where they found hundreds of images of child pornography. Id. at 273. On appeal, we rejected Shields’s probable cause challenge. Shields did not argue staleness, but we raised the issue sua sponte and concluded that the information in the affidavit was not stale, despite the nine-month gap between the warrant application and any possible participation by Shields in the child pornography groups. Id. at 279 n. 7.

We reiterate that staleness is not a matter of mechanically counting days. Zimmerman, 277 F.3d at 434. Nevertheless, our conclusion in Shields that a nine-month gap did not render the information stale counsels in favor of the same result here, given the similar “nature of the crime[s]” involved, id., and the fact that the gap here was only four months. We therefore hold that the information in Agent Desy’s affidavit was not stale. As the affidavit explained, and as we have long recognized, persons with an interest in child pornography tend to hoard their materials and retain them for a long time. See, e.g., Shields, 458 F.3d at 279 n. 7 (noting that “collectors of child pornography often store their material and rarely discard it”); Harvey, 2 F.3d at 1322-23 (rejecting staleness claim in part due to recognition that “pedophiles rarely, if ever, dispose of sexually explicit material”). Child pornography is illegal, and therefore difficult and risky to obtain. Presumably, once a child pornography collector gets his hands on such material he will not be quick to discard it. Zimmerman, 277 F.3d at 434. Vosburgh argues that this “hoarding” principle had no place in Agent Desy’s affidavit (and should not inform this Court’s staleness analysis) because the affidavit established no basis for concluding that Vosburgh was a child pornography collector. We disagree. The affidavit described repeated, deliberate attempts to access the Link — which, as the affidavit explained, was advertised as hard core child pornography and posted to an underground website explicitly and exclusively dedicated to such pornography — originating from an apartment in which Vosburgh lived by himself. Under these facts, we cannot say that it was unreasonable for officers to infer that the person responsible for those attempts already possessed some quantity of child pornography. See United States v. Wagers, 452 F.3d 534, 540