Finding the owner of an IP address.
Hi, everyone. Leo Notenboom here for Askleo.com,
this is a question I get a lot. It's very simple.
"How do I figure out who owns an IP address?"
I'm going to be clear from the beginning, you're not going to like my answer.
The bottom line answer is you don't.
Law enforcement might and we'll get to that in a minute, but you,
as the average user of an Internet connected device without any other
resources behind, you cannot find out who is at an IP address.
The good news is that they can't find out
who is at your IP address, whoever they might be.
But the bottom line is the information is simply not available. Now.
Why do people care?
And I tell you, people care passionately
at times and it usually boils down to harassment of some form.
They feel that they are being harassed
by someone, be it via email, via chat, via some other means.
And they've discovered the IP address,
what they think is the IP address of the person at the other end.
And they desperately, literally,
sometimes very, very desperately want to find out who that person is,
to find out who it is that's harassing them, who it is that is causing them this
grief so that they can usually tell them to stop.
Again, it's super important that you will not,
on your own be able to get this information, it's simply not possible.
I do want to show you, however, what information you can get.
There is some information available based on the IP address.
The first one.
I'm going to go to is something called Whois.
ARIN, the American Registry for Internet Numbers is a good place to start.
Their Web site has a search in the upper
right hand corner and you can enter in the IP address that you're interested in.
You'll get a report and what you will find is generally the ISP that owns the IP
address. They're the folks that hand out the IP addresses to the people that use them.
But that's about as far as you can go.
So, for example, in this example,
I've used .72.104.186.113
An IP address that I happen to know is assigned and it returns.
Well, Wireless Data Network as the name
of the organization, but of course it is a Verizon Wireless IP address.
That IP address is owned by the Verizon Wireless mobile service
and has been assigned to an individual using presumably a mobile device.
That's typically, as far as you and I can go with a court order,
law enforcement may and I have to again, stress may be able to find out
who happened to be assigned that specific IP address.
If you can also determine when you're interested in it.
As we know, IP addresses can be reassigned.
And that's nowhere more true than it is
for mobile IP addresses with devices going on and offline all the time.
So when and what the IP address, plus a court order,
meaning you've got a sufficiently important case in the terms of law
enforcement, may be able to get you further.
Now, there's something also called reverse DNS that can sometimes be kind of helpful,
at least interesting if you do a reverse DNS on something.
What that really means is you are mapping
an IP address to a name we normally think of.
DNS is mapping a name to an IP address.
For example, when you visit Askleo.com,
your browser does a DNS request to find out what the IP address is of Askleo.com.
If you do the reverse, you say, what's the name of this IP address?
You may get Askleo.com or you may get
the name of the server that it's on, or you may get more than that.
One of the realities of the Internet is
that, of course, there aren't enough IP addresses to go around.
One of the ways that gets solved is with shared hosting.
When websites share hosting with other
websites, they all live on a single server and they all use the same IP address.
So, for example,
if we look up using a different service hackertarget.com/reverse-ip-lookup,
I look up 69.89.31.214.
Again, that's an IP address I know has been assigned to a specific Web site.
It's been assigned to a lot of website, that particular IP address,
and points to a shared hosting server that contains hundreds,
if not thousands of different domains that all use the same IP address.
The IP address correctly locates the server, which with that many domains
is probably a pretty beefy server, but it is still a single IP address,
referring to any of a thousand different Web sites.
And you don't know which one might have been reaching out.
Now, the last thing that people tend
to look for is something that we call geo IP.
It's basically geo locating or trying
to find out where an IP address actually terminates, where it lives.
Unfortunately, that, too, is notoriously inaccurate
and typically limited only to the location of the ISP that hands out the IP address.
So, for example,
if we use that Verizon Wireless IP address, the report that I've got in front
of me says that it's in Chattaroy, Washington.
I don't even know where that is.
And it's certainly nowhere near that IP address is actually in use.
If you look up the IP address on my home
IP address, it's off by like five or six miles.
It's a completely different city that gets reported.
So Geo IP can get you at least
the country, often the region and sometimes the city.
But rarely, rarely does it even get close to the actual location of the computer
that's using that specific IP address at the moment.
Like I've said before, this probably isn't what you wanted.
Yeah, all that information that I just
talked about is interesting, but it's not precise enough to solve
the problem that most people come here asking.
You can't get there from here.
If you've got a real problem
with someone that seems to be communicating with you using a specific IP
address that you can document, including the time,
your only recourse is to either complain to that person's ISP,
which you now have the resources to find out or engage law enforcement.
If it's important enough to engage law enforcement and they have the resources
to do so, then they have the ability to ask
for the information that you really want but can't get yourself.
I hope that's helpful.
I hope that clarifies.
I hope that prevents you from wasting a lot of time trying to beat your head
against all these different IP location services.
That really can't turn you much for updates, for related links.
For comments and more, visit askleo.com/2123.
Notenboom. This is Askleo.com.