IanMason - 6:19 pm on Jun 18, 2005 (gmt 0)

Persepee: building upon the suggestion of globalissa and recognizing the concern raised by publish whereby a site may not be using their ISP’s name server, here are the steps that I take to identify the actual network provider.

Begin by obtaining the IP address used by the domain in question. Use a command line utility such as nslookup or dig to resolve the domain name to the IP address. A search of Google using “nslookup” as a search term will yield web based interfaces as well.

Once you have obtained the IP address the next step is to identify to whom that IP address has been assigned. As of today’s date, I know of four global IP registrars listed as follows:

www.arin.net
www.ripe.net
www.apnic.net
www.lacnnic.net/en/

Each of these registrars operates a whois service on their main page. Unlike the domain name based whois service, this service takes an IP address and responds with the name of the network owner to which that IP address has been assigned. Simply go down the above list of registrars until you obtain your answer.

With the answer in hand you may once again use globalissa’s excellent suggestion to obtain further information. While keeping in mind the limitations noted by publish on dealing with spammers, you may wish to explore RBL (Real Time Blacklists) through a Google search.

I hope this helps – if any part is unclear please sticky mail me.