IP Address question-analysis

[bostonseo]

I really have no idea how IP addresses are assigned so I thought I'd ask here.

The other day was a terrible conversion day on Adwords so I pull my weblogs and analyzed them. I did not see exact duplicate IP address for clicks on the same keyword - but I noticed that quite a few of the IP address were very similiar.

For example:

I got a click from an IP address that starts 24.238. and then 8 minutes later a click from an IP address that starts 24.98.

I got a click from an IP address that starts 67.166. and then 11 minutes later a click from an IP address that starts 67.65.

I got a click from an IP address that starts 72.11. and then 2 minutes later a click from an IP address that starts 72.227.

These are 3 examples out of only 10 clicks for this keyword. It just seems very suspect that within such a short span of time I am receiving clicks from an IP address that starts with the same 2 digits.

If I had received a lot of clicks then I wouldn't think too much of this, but given how that I only had 10 clicks the entire day and had 3 situations where this happened has my wondering if this is suspicious.

Any thoughts?

[netmeg]

I do a lot with IP numbers as far as hosting, anti-spam filters and log tracking, and I don't think that's all that significant. For example, the 24.* numbers. Most of the 24.* numbers I see are from cable modems; in the past 24 hours on one of my sites, I've seen different 24.* numbers from Comcast, Charter, and Cablespeed. There are so many cable users, those are easily legit. I've got some 67.* that are also Comcast, and a couple of 72.* that track back to "unknown".

You can also do a whois -a on an IP number to see where it originates.

[bostonseo]

Thanks netmeg. I don't think you can do a whois look-up on an IP address; I tried it on the whois tool on register.com and domain.com - neither worked.

Do you know another website that does allow whois loop-up by IP address?

[netmeg]

Network Solutions - on the bottom of the site where it says WHOIS; if you go to the page it will give you the option to look up the IP Address owner. I dunno if this is a TOS violation or not; if it is, someone will nuke it and you can sticky me.

[bostonseo]

Thanks nutmeg, that worked!

[netmeg]

NETmeg! It's a PUN! (ork ork)

[bostonseo]

my bad netmeg :)

[gregbo]

IP addresses are assigned in blocks. The best education for IP address allocation is the Internet RFCs available from the IETF site. It is perfectly valid to get IPs that fall into the same netblock from different users (but a clever fraudster can take advantage of this and disguise its traffic).