Identify IP address
Does anyone know of a good tool to identify who owns an IP address? I am aware of http://whatismyipaddress but it shows that the ISP owns that but doesn't get into details as to the individual or company that owns it.
I use Nirsoft IPNetInfo when I find more useful that TamoSoft Smart Whois.
Info Sniper returns the in-addr.arpa name of the address, if it has one. It also identifies the location of the address by geolocation.
The geolocation information can be useful but it can also be wildly incorrect, and it all depends on how accurate the registry is. There are some blocks of addresses that are scattered all over the world.
The MX Toolbox site is useful when looking for an ARIN site.
Regarding chasing down web site offenders ...
When looking for information on a problem visitor such as a blog spamming bot, it's common to chase the address back to a commercial hosting server farm. These addresses turn over rapidly as spammers and other offenders look for addresses not been blocked by Project Honeypot, Spamhaus or other DNSBL. Generally when I find this to be the case, I block the whole server farm -- imo, there is little legitimate traffic to my web sites from server farms. A site with a low-tolerance policy quickly finds the value in an iptables script blocking common offender addresses.
Side note: When trying to find information on a non-ARIN site the results are often spotty, especially in Third World or eastern European countries.
The geolocation information can be useful but it can also be wildly incorrect, and it all depends on how accurate the registry is. There are some blocks of addresses that are scattered all over the world.
The MX Toolbox site is useful when looking for an ARIN site.
Regarding chasing down web site offenders ...
When looking for information on a problem visitor such as a blog spamming bot, it's common to chase the address back to a commercial hosting server farm. These addresses turn over rapidly as spammers and other offenders look for addresses not been blocked by Project Honeypot, Spamhaus or other DNSBL. Generally when I find this to be the case, I block the whole server farm -- imo, there is little legitimate traffic to my web sites from server farms. A site with a low-tolerance policy quickly finds the value in an iptables script blocking common offender addresses.
Side note: When trying to find information on a non-ARIN site the results are often spotty, especially in Third World or eastern European countries.
ASKER
Thanks for all the solution provided but it is still vague as it doesn't show who the owner is of the ip address. It just shows you the system.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
@LateNaite - Thank you and I was happy to help.
Be aware that high volume spammers apparently own their own ISP's and you will not get much information from these from any tool.
If the information is publicly available, Smart Whois will give it to you.