How do I find an IP address ?

[Humpback]

Calling all computer buffs
I had an email today from this esteemed site saying someone (giving an IP address) had tried to log onto my account.
Now I would like to check who it was.
Any pointers as to how to go about this would be welcomed.
Alan

 

[GreenmanBushcraft]

It was a wee problem with the site, nowt to worry about You can often check your own IP along the top task bar with some ISP's.

Kris

 

[CLEM]

Calling all computer buffs
I had an email today from this esteemed site saying someone (giving an IP address) had tried to log onto my account.
Now I would like to check who it was.
Any pointers as to how to go about this would be welcomed.
Alan

Me too,I had the same email earlier!

 

[Humpback]

Thanks for the prompt answer.
The only thing I hack into are the woods.
Alan

 

[Tadpole]

just what is it you want to do? find the owner of an IP, the location, the city, if so try this site

http://www.geobytes.com/IpLocator.htm?GetLocation

 

[Toadflax]

Although this problem turned out to be a problem with the BCUK site, you can often find the 'owner' of an IP address (or domain) from your own PC.

I'm writing this assuming that you don't know anything! If you know what I'm talking about, then this message isn't aimed at you!

Assuming that you are running Windows XP, Click on Start | Run and enter the command "cmd" (without the quotes) - alternatively, select Start | Programs | Accessories | Command Prompt. You should get a black window appearing.

Type in the command "nslookup" (again without the quotes) and press <Return>. You should get a few messages followed by a chevron prompt (>).

Simply type in the IP address that you want to find (e.g. 83.170.96.59) and you should then get the name of the computer that has that IP address. In this case it is server40058.uk2net.com, which sounds very much like an ISP name. If you then Google uk2net.com, it does indeed turn out to be a web hosting company. You can do the reverse, and type in a domain name (e.g. www.bushcraftuk.com) which returns the IP address 83.170.96.59) so we can see that this site is hosted here.

If you want a bit more information, do a Google for a "whois" web site and enter the domain name that you are interested in (e.g. bushcraftuk.com - remember to omit the "www.") and you should then get some details about who owns the domain and how long the current registration lasts. If it is a business, you can usually get the actual street address, but personal registrants can opt out of having their address publicly available. In this case the domain is apparently owned by TUCOWS (not a big white polar bear).

Load of non-bushcrafty information, and you're all probably thinking that he's just showing off his knowledge - which is probably true.


Geoff

 

[Tourist]

Same problem. The location is City of London, I also got the service providers details.

Thats about as far as you'll get as a civvy - you need warrants n' things to get any further, theoretically.

 

[Eric_Methven]

I got the same message today as well.

Eric

 

[scottishwolf]

Same here, was a wee bit concerned but thought it was strange as i was actually logged in at the time.

 

[Tadpole]

I tink that the problem is here, to be sure
the problem

 

[Jodie]

Geoff that was very interesting and useful actually, thanks. I've used the DNS lookup
and general whois-y stuff but I've never accessed it via C:\

I also miss telnet

 

[Martyn]

Although this problem turned out to be a problem with the BCUK site, you can often find the 'owner' of an IP address (or domain) from your own PC.

I'm writing this assuming that you don't know anything! If you know what I'm talking about, then this message isn't aimed at you!

Assuming that you are running Windows XP, Click on Start | Run and enter the command "cmd" (without the quotes) - alternatively, select Start | Programs | Accessories | Command Prompt. You should get a black window appearing.

Type in the command "nslookup" (again without the quotes) and press <Return>. You should get a few messages followed by a chevron prompt (>).

Simply type in the IP address that you want to find (e.g. 83.170.96.59) and you should then get the name of the computer that has that IP address. In this case it is server40058.uk2net.com, which sounds very much like an ISP name. If you then Google uk2net.com, it does indeed turn out to be a web hosting company. You can do the reverse, and type in a domain name (e.g. www.bushcraftuk.com) which returns the IP address 83.170.96.59) so we can see that this site is hosted here.

If you want a bit more information, do a Google for a "whois" web site and enter the domain name that you are interested in (e.g. bushcraftuk.com - remember to omit the "www.") and you should then get some details about who owns the domain and how long the current registration lasts. If it is a business, you can usually get the actual street address, but personal registrants can opt out of having their address publicly available. In this case the domain is apparently owned by TUCOWS (not a big white polar bear).

Load of non-bushcrafty information, and you're all probably thinking that he's just showing off his knowledge - which is probably true.


Geoff

All well and good if you are hunting down the owner of a website, but if you are trying to locate an individual internet user through their IP address alone, you are bang out of luck unless the ISP is happy to help and pass on their details - which they never do. All you can do is find out the ISP and that's it. In the case of many ISP's who use proxy servers, It's almost impossible for them to locate an individual beyond a broad geographic area from the IP alone, because the IP only points to the shared proxy server. To locate an exact machine using AOL for example, you also need the MAC address - and of course, AOL's help. Even with ISP's that give their users unique IP addresses, they usually change according to each login session, so you need the ISP's help to determine who was using a particular IP during a particular login. Even if in the fairly rare event that the IP is a permanent, static IP, you are unlikely to get any more info on the user beyond the ISP. You could run a port scan and hope one of their ports is open and try and dig some info out that way, but that would depend on them not having a firewall and is quite illegal anyway.

 

[Ahjno]

Already covered here

http://www.bushcraftuk.com/forum/showthread.php?t=25583

 

[tomtom]

Already covered here

http://www.bushcraftuk.com/forum/showthread.php?t=25583

Indeed, Tony had explained the problem in that thread and there is no need for two thread on the topic.

Thread locked and moved to the correct forum,

TT