IP Address Trace

Question

If you wanted to trace an IP address because that IP Address was the source of attacks and abuse, how would you accomplish this? Is there anything one can do to find who is using a given IP address and furthermore is there anything that can be done to stop it?

Update: The destination (where the server is) is in the USA. The source indicates that it is also USA but like someone suggested, the IP Address is likely spoofed... I'm still open to further input/details...

Thanks,
Frank

Good question - filing useful abuse reports is a Very Good Thing to Do. Often the "attacker" will be a malware-infected PC and the person running the source network won't even know there's a problem -- until you tell them, via an abuse report. — Ben Dunlap, Jun 18 '09 at 23:58

score 5 · Answer 1 · answered Jun 18 '09 at 23:53

5

If you've got a non-Windows machine, whois <ip> is your first step. This will tie the IP to a network and possibly even supply you with an 'abuse' contact, usually an email address. You can email an abuse report there. You can also try nslookup <ip> to get a domain name, and look that up on abuse.net.

If you're running Windows start with ARIN's web whois. That may lead you to another web whois service if the IP address is not located in the USA.

answered Jun 18 '09 at 23:53

Ben Dunlap

410
5
10

yes regarding the abuse, be sure to log a UTC time that you saw that particular ip address active so they can trace dhcp lease times if possible – Brendan Jun 19 '09 at 03:17

score 3 · Answer 2 · answered Jun 18 '09 at 23:52

The ISP that owns the IP is the only group that really know the identity of the person registered to an IP. The best info you can hope for is what you can get from dnsstuff.

If the matter is serious and you want something done about it, then your only option would be to report it to the police.

You could drop everything from that IP address in your firewall, which might help for a little while, but chances are if they are a decent cracker, they will be bouncing through proxies, and will just come in from a different angle.

If they are just probing for information, don't worry too much. Make sure your applications are OS are patched. If it is something more malicious like a DDoS attack, then there are firewalls that are able to stop them, I'm not familiar with them myself though. If they have already got in, then do a search here. I saw something a couple of days ago about how to recover from an intrusion.

I would hold off on talking to law enforcement until I was *really* sure this was a targeted attack. Much malicious activity online is automated and comes from Uncle Bill's infected home PC. — Ben Dunlap, Jun 19 '09 at 00:21

score 2 · Answer 3 · answered Jun 19 '09 at 00:30

Depending on the attack, (DoS, certain port scans, etc), the IP Address will most likely be spoofed. And, as others have already stated, even if you do get a valid (non-spoofed) IP, most likely the end host is a compromised machine that is being used as a stepping stone/ relay.

Also, never "hack-back" This is unethical, most likely illegal where you live, and doesn't help the situation in the least.

Anapologetos

score 0 · Answer 4 · answered Jun 18 '09 at 23:50

0

First step - use WHOIS to find out where the offending IP is; that'll get you a country, ISP/registrar, or even a business address, if you're lucky.

answered Jun 18 '09 at 23:50

RainyRat

3,700
1
23
29

score 0 · Answer 5 · answered Jun 18 '09 at 23:51

To stop attacks, just firewall the IP address as far "upstream" in your network as you can (at your border). To track down the "user" of an IP address, I generally use:

dig -x <IP> to get an idea of what the IP address might be (DSL, dialup, dynamic vs static IP, or even an honest-to-goodness colo box);
whois <IP> to find out who the responsible entity is for the netblock (should contain contact details if you want to report the abuse and try to get it stopped at it's source)
One thing I never do is use nmap on an IP address to get an idea of the OS and services running on the machine to see if I can remotely access it or crash it to stop the abuse. That would be naughty.

"That would be naughty". Yes, particularly if the "attacker" is malware running on someone's grandmother's infected home PC -- which is very likely. — Ben Dunlap, Jun 18 '09 at 23:55

score 0 · Answer 6 · answered Jun 19 '09 at 16:35

When tracking bad stuff back to it's source I always start with a web based whois lookup. I don't want any queries that appear to come from my address block going anywhere near the attack. My favorite is Network Solutions lookup: http://www.networksolutions.com/whois/index.jsp, and then I work back through the providers as appropriate to find the ISP that owns the address.

What next steps you take are really dependent on the type of attacks/abuse you're seeing. You could block attacks at your border, cut off the user's account (if they have one with you), you could email the ISP's abuse line and provide them data on the attacks (times, netflows, etc.) and let them cut them off, and in cases of criminal activity you could call the police.

I think it's worth pointing out here that in cases where you think you might call the cops, if the ISP is across state lines the FBI won't really be interested unless there is SIGNIFICANT financial losses. If you're dealing within a state, incidents like stalking or kiddie porn can be taken to the local police though.

IP Address Trace

6 Answers6