IP Address

[Statty Queen]

I hope I've posted in the right forum, but I was wondering if anyone can help?

Last week, I tried logging on to e-goat and was locked out for 15 minutes, due to someone unsuccessfully attempting to log in as me.

The good ol webmaster sent me an email with this person's IP address. My question is: Is there any way I can find out who someone is by their IP address?

I have a vague idea who it is, because the same thing happened with my Myspace account.

I'll be very, very grateful for any help

 

[monobrow]

I hope I've posted in the right forum, but I was wondering if anyone can help?

This is the section for E-Goat related tech questions, however I've moved it to the resident geeks lounge as the question is that you want to resolve an IP address......

The being locked out though usually happens on an IGS machine, if it's your home one, be worried!!

I'm sure one will be along soon.....

 

[wgaf]

http://www.ipligence.com/?gclid=CKLqwcOz_owCFRcGEgodKA21DA
Statty, try this, it'll give you a free search. It'll let you know where the IP addy is in the country. The problem you may have is that not all IP addys are static, some ISPs will change the addy each time you log on.

 

[mad_mo]

SQ,

I dont have the answer to your above question, but if individuals are accessing accounts you have, that falls under the Computer Misuse Act 1990.

If you have a fair idea, It may be worth informing them you will seek further legal advice with regard to this Act which makes certain offences criminial ones!.

 

[SirSaltyHelmet]

It happens now and again with the goat. More often than not it is an IGS issue.No one is trying to access your account.

Happened to me loads of times

http://www.e-goat.co.uk/forums/showthread.php?t=3947

 

[Statty Queen]

I WAS locked out in work, but my Myspace account was locked out at home. That's why I don't think it was just an IGS problem

 

[rugby then work]

If you want to PM me the IP address I'll look into it for you.

 

[rugby then work]

http://www.ipligence.com/?gclid=CKLqwcOz_owCFRcGEgodKA21DA
Statty, try this, it'll give you a free search. It'll let you know where the IP addy is in the country. The problem you may have is that not all IP addys are static, some ISPs will change the addy each time you log on.

The IP address will change at least every 8 days unless the person doing this (if anyone actually is) has paid to keep the same address.

 

[SirSaltyHelmet]

I think it is coincidence between myspace being logged out and the lock out with the goat. Are you using IGS for the goat?

 

[Major Geek]

The two may not be connected. I know MySpace is always being hacked, dont use it myself but my wife and kids accounts have been hijacked in the past and used to post links to porn and such.

 

[Statty Queen]

SSH, I do use IGS for the goat, maybe it was a coincidence, but I think it's someone who doesn't trust me and was trying to read my PMs and also my inbox on Myspace.

Thanks RTW, but Hu got to me first, so I PM'd him the address, and he's sorting it out his end.

 

[shettie]

SQ - tracing the IP address is not going to prove where a person is... My IP address will indicate that my PC is in nottingham - and I'm not (thats where my ISP's DHCP server must be - thats the server that issues the IP address to your PC) The other problem that you will find is that - if its come from an IGS machine - you'll probably find, like my work network (14000 pcs...) - IGS connects to the interworld using one IP address - and that is what will be shown when you try the find it, hiding the actual "internal" network address. Investigations would indicate that the IP belonged to an ISP (or in the case of the RAF, - MOD probably...) Not very helpful i'm afraid...

As MM stated - its against computer misuse legislation - personally I would confront them - especially if this happened on a work PC... and perhaps involve your friendly local SI/IT plod on camp

 

[The Fact Hunter]

Is there any way I can find out who someone is by their IP address?

Hi SQ,

If you want to have a go at the problem yourself, I can recommend some freeware software downloads from:-

Wireshark - http://www.wireshark.org/download.html

This is a 'protocol analyser' and will tell you who is on/using/or more importantly - trying to use - your network

Sam Spade - http://www.pcworld.com/downloads/file/fid,4709-order,1-page,1-c,alldownloads/description.html

This will perform all manner of IP address lookups/reverse lookups etc etc

 

[flounder_al]

but if individuals are accessing accounts you have, that falls under the Computer Misuse Act 1990.

If you have a fair idea, It may be worth informing them you will seek further legal advice with regard to this Act which makes certain offences criminial ones!.

A very useful document and one i am using at the moment as someone has illegally entered my restricted website. Solicitor was impressed i knew about it DT_Xtremez_30:

 

[prop135]

Hi SQ,

If you want to have a go at the problem yourself, I can recommend some freeware software downloads from:-

Wireshark - http://www.wireshark.org/download.html

This is a 'protocol analyser' and will tell you who is on/using/or more importantly - trying to use - your network

Sam Spade - http://www.pcworld.com/downloads/file/fid,4709-order,1-page,1-c,alldownloads/description.html

This will perform all manner of IP address lookups/reverse lookups etc etc

Wireshark will only show the packets passing through the network card on SQs PC, thats fine if someone is trying to gain access to a home PC/network. In this case the attacker is not after a PC just a user account on a web site. This is an excellent tool though.

Sam Spade is good too but in this case it will probably prove useless. As stated earlier in the thread it is not likely that the attackers IP is the same now as it was at the time of the attack. Even if it was Sam Spade will probably only trace back to an ISP.

 

[The Fact Hunter]

Wireshark will only show the packets passing through the network card on SQs PC, thats fine if someone is trying to gain access to a home PC/network. In this case the attacker is not after a PC just a user account on a web site. This is an excellent tool though.

Wireshark actually sets the NIC card into 'promiscuous mode' and will see any/all traffic that is on the local net - ie after the routers default gateway and before any PC's firewall. It will capture any session and show port details going in and out. You can freeze/capture this data and use it as evidence

Sam Spade is good too but in this case it will probably prove useless. As stated earlier in the thread it is not likely that the attackers IP is the same now as it was at the time of the attack. Even if it was Sam Spade will probably only trace back to an ISP.

Once you have captured your data with Wireshark, you can paste it into Sam Spade to do many look-ups such as Whois/DiG/Trace etc and this will lead to an ISP, but then (unless a proxy address has been used) you can press the built-in 'report abuse' button and file a report. ISP's only have an allocated suite of registered addresses that they can 'spread about' and are anyhow cached to the originators DNS. ARIN will investigate them if reported.

 

[prop135]

Wireshark actually sets the NIC card into 'promiscuous mode' and will see any/all traffic that is on the local net - ie after the routers default gateway and before any PC's firewall. It will capture any session and show port details going in and out. You can freeze/capture this data and use it as evidence

Yes, but if you read the opening post on this thread then you will see that it refers to someone posting to a web page not hacking someones home network. This makes wireshark redundant at this point. Even in promiscuous mode, if it is a swithced network wireshark will not see directed traffic, only broadcast and management traffic if it is on the same subnet.

Once you have captured your data with Wireshark, you can paste it into Sam Spade to do many look-ups such as Whois/DiG/Trace etc and this will lead to an ISP, but then (unless a proxy address has been used) you can press the built-in 'report abuse' button and file a report. ISP's only have an allocated suite of registered addresses that they can 'spread about' and are anyhow cached to the originators DNS. ARIN will investigate them if reported.

Again not any use given the current thread