By Leo Notenboom

It’s critically important that you realize that you will not, on your own,
be able to get the name, location, phone number, email address or any other
specific information with just an IP address. Not only can an IP address change
or be shared among many computers (and hence people), but the information that
you’re seeking is considered private and is protected by the ISP who owns that
IP address.

To get that information, you’ll need a legal reason to require it and that
typically means a court order of some sort.

Let’s look at what you can determine from an IP address on your own and a
few tools that will help you determine at least the ISP that owns it.

I’m going to use several different tools in this example because each
provides valuable information, even though they might overlap quite a bit as
well.

Whois

“Whois” is a service that basically answers the question “who is X” where X
is an IP address, a domain name, and several other things.

ARIN, the American Registry for Internet Numbers, is a fine place to start.
The ARIN Whois can be accessed from "http://whois.arin.net">http://whois.arin.net in the upper right
corner:

"http://img.askleomedia.com/2011/arin_whois.png" alt="ARIN whois search box"
title="ARIN whois search box" />

Enter the IP address you’re interested in and press Return. I’ll use
64.105.215.206 (an IP address that I know to be assigned, but at this writing, is unused)
as my example:

"http://img.askleomedia.com/2011/whois_covad.png" alt=
"whois lookup of an IP address" title="whois lookup of an IP address" />

This is pretty typical of what you’ll get: information that identifies the
ISP who owns the “block” of IP addresses that contains the IP address that you asked
about. In this case, the block includes all IP addresses from 64.105.0.0 through
64.105.255.255.

With a court order, law enforcement would then approach the ISP for more
detailed information about who that IP address is assigned to.

Also note that it’s possible that the information presented may point you to
a different whois server – ARIN covers IP addresses assigned in North America;
there are other services for the rest of the planet.

Reverse DNS

In some cases, reverse DNS can be instructive.

DNS is the mapping of a domain name, like “ask-leo.com”, to an IP address.
Reverse DNS does, as its name implies, the reverse – given an IP address finds
the domain name that has been assigned as the primary identifier.

I’ll use a tool from a third-party vendor this time, "http://whois.domaintools.com">http://whois.domaintools.com:

"http://img.askleomedia.com/2011/whois_rdns.png" alt=
"Whois information from domaintools.com" title=
"Whois information from domaintools.com" />

You can see that this gives much of the same information that we’ve seen above,
namely the ISP who owns that IP address. But there’s an additional tidbit of
information.

Article Continued Here

This post is excerpted with Leo’s permission from his blog.

FaceBook URL: Leo’s Facebook

Twitter URL: http://twitter.com/askleo

About Leo Notenboom

Leo A. Notenboom is the owner of Puget Sound Software, LLC and the Leo in Ask Leo!. Leo has been in the personal computer and software industry since 1979, as a software engineer, a manager of software engineers, and as a consultant. In 1983 Leo joined what was then a medium sized local company called Microsoft and spent the next 18 years in a wide variety of groups working on a wide variety of software. If you're running Microsoft Windows, if you've used a Microsoft development tool or Microsoft Money, or if you've ever purchased a ticket through Expedia, there's a good chance you've been touched by some of his work. And of course, since 2003, Leo has been answering your tech questions on Ask Leo!

• 
• 
• 
• 
•