# How do you find the ISP for an IP? **URL:** \ **Category:** Factual Questions\ **Created:** [April 14, 2004, 2:40pm UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970 "2004-04-14T14:40:37Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Sensualips](https://avatars.discourse-cdn.com/v4/letter/s/7c8e57/32.png) [@Sensualips](https://boards.straightdope.com/u/Sensualips)\ **Post date:** [April 14, 2004, 2:40pm UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/1 "2004-04-14T14:40:37Z")
I was playing an online game (Counterstrike) when someone infected my computer and corrupted the game. I have the server’s IP (69.93.191.164:27017), how can I either register a complaint with the ISP, or otherwise get things taken care of? ---
**Author:** ![ccwaterback](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@ccwaterback](https://boards.straightdope.com/u/ccwaterback)\ **Post date:** [April 14, 2004, 3:06pm UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/2 "2004-04-14T15:06:05Z")
Maybe this will help? [http://spoof.fragfortress.com/](http://spoof.fragfortress.com/) ---
**Author:** ![Will\_Repair](https://avatars.discourse-cdn.com/v4/letter/w/a698b9/32.png) [@Will\_Repair](https://boards.straightdope.com/u/Will_Repair)\ **Post date:** [April 14, 2004, 3:13pm UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/3 "2004-04-14T15:13:58Z")
I googled “ip lookup” and got this as the second in the list: [http://kresch.com/resources/lookup.php](http://kresch.com/resources/lookup.php) . Actually placing the ip in the form is left as an exercise for the op. ---
**Author:** ![Aitara](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@Aitara](https://boards.straightdope.com/u/Aitara)\ **Post date:** [April 14, 2004, 4:00pm UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/4 "2004-04-14T16:00:33Z")
I like Geektools quite a bit, it will give you the registration information for that IP. It generally includes name, address and more importantly for your purposes, an abuse email. [http://www.geektools.com/whois.php](http://www.geektools.com/whois.php) ---
**Author:** ![spiralscratch](https://avatars.discourse-cdn.com/v4/letter/s/dfb087/32.png) [@spiralscratch](https://boards.straightdope.com/u/spiralscratch)\ **Post date:** [April 15, 2004, 6:46am UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/5 "2004-04-15T06:46:44Z")
[ARIN](http://www.arin.net/) can be used to see who an IP address is currently assigned to. ---
**Author:** ![ComeToTheDarkSideWeHaveCookies](https://avatars.discourse-cdn.com/v4/letter/c/e9bcb4/32.png) [@ComeToTheDarkSideWeHaveCookies](https://boards.straightdope.com/u/ComeToTheDarkSideWeHaveCookies)\ **Post date:** [April 15, 2004, 11:50am UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/6 "2004-04-15T11:50:19Z")
> [@spiralscratch](#): > > [ARIN](http://www.arin.net/) can be used to see who an IP address is currently assigned to. ARIN = American Registry of Internet Numbers It is certainly a good place to start, but you may very well also need to hit [APNIC](http://www.apnic.net/) (Asia Pacific Network Information Center), or [RIPE](http://www.ripe.net/db/whois/whois.html) (Réseaux IP Européens), among others (though I’ve rarely had to querey any other than these three.) ARIN will at least usually point you in the right direction if that direction lies elsewhere. The information on any of these sites can be out of date, depending on how current the ISP is on updating their records. If things look murky, you can try running a traceroute and also look up some of the other IP’s on nearby hops. ---
**Author:** ![arteitle](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@arteitle](https://boards.straightdope.com/u/arteitle)\ **Post date:** [April 15, 2004, 2:12pm UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/7 "2004-04-15T14:12:06Z")
How about good ol’ nslookup? It gives me this: Name: [164.69-93-191.reverse.theplanet.com](http://164.69-93-191.reverse.theplanet.com) Address: 69.93.191.164 Which leads to this: [http://www.theplanet.com](http://www.theplanet.com) ---
**Author:** ![ComeToTheDarkSideWeHaveCookies](https://avatars.discourse-cdn.com/v4/letter/c/e9bcb4/32.png) [@ComeToTheDarkSideWeHaveCookies](https://boards.straightdope.com/u/ComeToTheDarkSideWeHaveCookies)\ **Post date:** [April 15, 2004, 2:39pm UTC](https://boards.straightdope.com/t/how-do-you-find-the-isp-for-an-ip/239970/8 "2004-04-15T14:39:47Z")
> [@Sensualips](#): > > how can I either register a complaint with the ISP, or otherwise get things taken care of? ack…I missed this part of the OP [[whois.arin.net](http://whois.arin.net)] OrgName: [ThePlanet.com](http://ThePlanet.com) Internet Services, Inc. OrgID: TPCM Address: 1333 North Stemmons Freeway Address: Suite 110 City: Dallas StateProv: TX PostalCode: 75207 Country: US NetRange: 69.93.0.0 - 69.93.255.255 CIDR: 69.93.0.0/16 NetName: NETBLK-THEPLANET-BLK-9 NetHandle: NET-69-93-0-0-1 Parent: NET-69-0-0-0-0 NetType: Direct Allocation NameServer: [NS1.THEPLANET.COM](http://NS1.THEPLANET.COM) NameServer: [NS2.THEPLANET.COM](http://NS2.THEPLANET.COM) Comment: RegDate: 2003-11-19 Updated: 2004-03-15 TechHandle: PP46-ARIN TechName: Pathos, Peter TechPhone: +1-214-782-7800 TechEmail: [abuse@theplanet.com](mailto:abuse@theplanet.com) OrgAbuseHandle: ABUSE271-ARIN OrgAbuseName: Abuse OrgAbusePhone: +1-214-782-7802 OrgAbuseEmail: [abuse@theplanet.com](mailto:abuse@theplanet.com) OrgNOCHandle: TECHN33-ARIN OrgNOCName: Technical Support OrgNOCPhone: +1-214-782-7800 OrgNOCEmail: [admins@theplanet.com](mailto:admins@theplanet.com) OrgTechHandle: TECHN33-ARIN OrgTechName: Technical Support OrgTechPhone: +1-214-782-7800 OrgTechEmail: [admins@theplanet.com](mailto:admins@theplanet.com) [[whois.abuse.net](http://whois.abuse.net)] [abuse@theplanet.com](mailto:abuse@theplanet.com) (for [theplanet.com](http://theplanet.com)) So to file an abuse complaint, you need to send logs to **[abuse@theplanet.com](mailto:abuse@theplanet.com)**. The logs you need to send must include: [ul] [li]The IP address of origin[/li][li]Exact date and time of the incident, including the timezone that your[/li] _software_ is using for logging purposes (not necissarily your local TZ). [li]A description of the abusive activity such as source and destination ports[/li][/ul] Use common sense when submitting logs. If you have 20 pages of the same sort of activity, and the only thing changing are the tenths of a second in your timestamp, then send an abbreviated snippet of your logs: First 10 lines of page #1 \ Last 10 lines of page #20 [Here](http://www.robertgraham.com/pubs/firewall-seen.html) is a decent site to help make the determination of whether or not logged activity is deserving of an abuse complaint.