Find Owner of IP Address

[Pleiades]

I have a client who has a former employer who has tried to connect through the company VPN (presumbably to procure Intellectual Property for his new employee). I found log entries showing the login failure, with the IP address from which the connection was attempted.

How can I track down the owner of this IP address? I imagine that it is owned by an ISP, but if it got to the courts, the ISP would be able to check their records of who had that address assigned at that time.

Cheers.

Try the comand line utility `whois' or `traceroute':

whois 69.105.56.*
Pac Bell Internet Services PBI-NET-0803 (NET-69-104-0-0-1)
                                  69.104.0.0 - 69.111.255.255
PPPoX Pool - Rback3 IRVNCA SBC069105056000040104 (NET-69-105-56-0-1)
                                  69.105.56.0 - 69.105.59.255

traceroute 69.105.56.*
traceroute to 69.105.56.* (69.105.56.*), 30 hops max, 38 byte packets
 1  adsl-69-105-56-*.dsl.irvnca.pacbell.net (69.105.56.*)  49.762 ms  0.447 ms  1.171 ms

They both return the users ISP, assuming the user isn't behind a proxy of course.

[Pleiades]

Cheers, cassius. I'll give that a crack.

[krinkstar]

I work for an isp, and we sometimes get asked who was using what IP at a given time, and/or what phone number they dialed in from if applicable, which is a fairly trivial affair to find out from our logs.

Actually, it looks like that was a statement rather a question on your part, heh, but they definately can find out that kind of information.

[Compunuts]

But ISPs won't give out that information to you (a third party).

IRAA and MPAA can't even get that info from Verizon.

[Schotty]

[quote author=Compunuts link=board=4;threadid=10068;start=0#msg91784 date=1105431127]
But ISPs won't give out that information to you (a third party).

IRAA and MPAA can't even get that info from Verizon.
[/quote]

No, but if I had a subpoena I could.

The feds won't do anything unless you incur high amounts of losses, somewhere around 5k if I remember correctly. I'm sure some ISP's may give you the info you're searching for but those are probably the kind of ISP's customers should stay away from.

[Compunuts]

[quote author=Schotty link=board=4;threadid=10068;start=0#msg91807 date=1105489548]
No, but if I had a subpoena I could.
[/quote]
But you have to first have to proof to get subpoena. Unless you can proof that the substantial damage had occured, this ruling will strike down any requests.