Finding out which ISP owns an IP address


InternetPeriscope enables you to find out which ISP owns a given IP address. You might do this after you detected an Intrusion attempt, or if you wished to contact an ISP to notify them that you received unsolicited email (SPAM) from their network.

If you only have a domain name (e.g. www.microsoft.com), you should first use DNS to find out the IP address of the domain. Then you can find out which ISP that hosts this IP address, as described below.

In this example, the user wishes to find out which ISP is responsible for the IP address 212.174.160.27. She wishes to do this because she has detected an intrusion attempt by a hacker from this IP address, and wishes to notify the ISP of the intrusion attempt.

To begin, she clicks on the Tools menu, moves her mouse over the "Whois" sub-menu, and then clicks on "IP Address...", as shown in the figure below.
Tools Menu

She then enters the IP address into the Search String text box, and presses the Search button. Note that she has left the Registry with the default "American Registry for Internet Numbers (ARIN)" . This registry keeps track of which IP addresses are used on the American continents.
Search String

After a few moments, the results shown below appear. Unfortunately, she has not yet found the ISP responsible for this IP address. The results are telling her that the European Regional Internet Registry/RIPE NCC (RIPE) is responsible for IP addresses in the range 212.0.0.0 - 212.255.255.255. She needs to run her search again, but this time using "RIPE" as the registry, instead of "ARIN".

Note: Had the address been in Asia, she would have been referred to the "Asia Pacific Network Information Center (APNIC)", and would have used this registry in the steps outlined below.

APNIC

She clicks on OK to remove the Whois Results dialog. She then changes the Registry in the "Search whois.arin.net" dialog to "RIPE", and again clicks on the Search button, as shown below.
Search

She scrolls through the results, finding a number of contacts for this IP address range. She also discovers that this intrusion attempt came from somewhere in the country of Turkey.
Contacts



Problems, Comments, Suggestions? Click here to contact Greg Thatcher
Please read my Disclaimer





Copyright (c) 2013 Thatcher Development Software, LLC. All rights reserved. No claim to original U.S. Gov't works.