Determining ISP from an IP address

I know that this is a newbie question that's probably been asked before, but I tried doing searches on this site and couldn't find anything.

I also tried searching on Google, and all I found were some sites that had some utilities to download to find this information out. However, I'm not about to just start downloading and installing any application, so I thought I'd post a message here. Does anyone know of a good app/utility/website to find this info out? My firewall's going nuts reporting this one IP address scanning like every port on my machine, and I wanna find out who it is and report him. Thanks.

www.samspade.org

Ammo

i get the same thing at least 26 alertts in 1 or 2 seconds and i found out by whois that it was scannerabuse.blueyonder.co.uk which
is my isp is this normal u r isp running porty scans on u r box oh yea try what ammo said :)

prodikal: what port?

Ammo

sweet!!! thanks for the tip!

prodikal id send them a copy of the log just incase somebody hi-jacked their server.

Well, Some ISP's tend to ping users on its network to see if the connection is still live. But 26 in 2 seconds isn't normal. Sounds like someone did a scan on you.

As far as finding out what ips are associated with which I always use ARIN located at http://www.arin.net/whois/arinwhois.html


Or do a search for "WHOIS" on google and you can find many more.

ammo the ports are 50734. 6588. 50735 .1080. 50736. 50736. 50812
6588.50813.50814.50815.50875.6588.50876.50877.50878.50946.50947
6588.50948.50949.51013.51014.6588.51015.51016.51076.51077.51078
51079.37358
im not really worried about it but does u r isp usually port scan u r box is this normall behaviour

Well, do to the fact that some of the ports are sequential it looks like someone scanning. You did say this was in 1 or 2 seconds right?

Normally if an ISP does ping you its just a random high number port, but only once in a while, and not in a sequential pattern like this. I would notify it to the Admin of the network. Its kinda strange.

yes xmaddness the first alert shows and the counter just keeps riseing when i went 2 whois it said it was scannerabuse.blueyonder.co.uk
does scanner abuse mean anything 2 any 1 ? any feed back would be great thanx for u r help allready much apprecciated

If you provided the whole WHOIS lookup I could help more.

It looks to me like scannerabuse.blueyonder.co.uk is where to report any scanning abuse by someone on their network (Blueyonder.co.uk is the ISP). It should provide an abuse email where you can send a firewall log report to along with the IP scanning you.

Don't rule out the following programs that use some of these ports, RealPlayer, IM, WinAmp, etc, as well as for spyware, most to me look like the high ports many of these programs use to push ads, getting real used to the RealPlayer hits when people in the office use it. What is running when these or this scan hit? Google search like port scan and the port see what it says, then look to see what is running.

domain name blueyonder.co.uk
registerd for telewest communications
registerd on 19th-oct-99
record last update on 28-may 2002 by [email protected]
domain servers listed in order
ns.blueyonder.co.uk 195.188.53.114
ns2.blueyonder.co.uk 195.188.53.113
ns3.blueyonder.co.uk 194.117.152.85
whois from neotrace express

domain name blueyonder.co.uk here goes xmaddness
registerd for telewest communications
registerd on 19th-oct-99
record last update on 28-may 2002 by [email protected]
domain servers listed in order
ns.blueyonder.co.uk 195.188.53.114
ns2.blueyonder.co.uk 195.188.53.113
ns3.blueyonder.co.uk 194.117.152.85
inetnum: 193.38.36.0 - 193.38.127.255
netname: UA
descr:united artists
country: gb
admin-c CS82-RIPE
tech-c CH2524-RIPE
rev-srv ns.cablenet.net
rev-srv ns2.cablenet.net
rev-srv homer.telewest.co.uk
status assigned pa
mint-by ripe-ncc-none-mnt
changed [email protected] 19960529
changed [email protected] 19990706
changed [email protected] 20010221
source ripe
route 193.38.96.0/19
descr telewest broadband
origin as5462
notify [email protected]
mint-by as5462-mnt
changed [email protected] 20020610
person chris stallwood
address telewest communications
address unit 1 genisis buissness park
address working surrey gu215rw
address united kingdom

from neo trace express

yup... e-mail [email protected] with the logs and an explanation of what happened. See what he says.

thanks again xmaddness i will do it first thing 2 morro its like 3.00 am here ty again :) <rant>with a tired look in his eye </rant>

looking at your print outs, somethings missing to me. where's the addy that scanned you. i see whois blueyonder.co.uk.

if you do a ping -a of the ip address that scanned you what does it say?

is it a pointer?(PTR)

Try Arin Whois on www.google.com