Find contact details for an IP address

Aim of this article:

This article provides instructions for finding out who to contact in relation to activities from an IP address.  This may be necessary for detecting the source of abuse - e.g. unsolicited e-mails - so a complaint can be logged.

Searching the IP databases:

Once a source IP has been identified we can query the RIPE database. (For more information on RIPE please see http://www.ripe.net/ripencc/about/).

The RIPE database can be found at http://www.ripe.net/db/whois/whois.html. To do a complete search, it is best to click on Advanced Search. This will take you to the following screen:

From here we need to change the search so that it interrogates other databases, in addition to RIPE. We can do this by selecting ALL from the Alternative database option:

You can now enter the IP address into the white Search for box and click Search. Once you have done this, scroll down to see the results.
 
Don’t feel overwhelmed by the amount of information here; most of it is not relevant. You should notice that within this data there is information about the organisation that owns these addresses. Scroll down further and there should be a reference to the procedure for abuse issues. Using the IP address in our example, the following information can be retrieved:

Unfortunately, there is no common standard for how this information will be presented; it is up to the individual ISP/organisation to do this. In most cases, you should be able to find it pretty quickly.

Once you know the responsible party for the address, you can send an e-mail to their abuse department explaining the situation. You will need to include a copy of the message, including the headers, to aid in the discovery of those responsible and to back up your complaint.

This method requires the cooperation of the ISP you are reporting the complaint to. Most principled ISPs will deal with these complaints seriously and take action against those responsible. Unfortunately, because of the nature of the Internet, Zen cannot guarantee that all ISPs will provide an e-mail address for spam reports.

Other Databases:

RIPE is not the only database you can search in, and sometimes the information it retrieves from other databases is not complete. You can use search tools on the following sites if you are unable to find details in the RIPE database: