0

How can someone determine if a given IP range is in a datacenter or for home usage etc.? Companies like MaxMind provide lists of IPs located in hosting centers. How do they get this information? Do they simply look for specific fields in whois? or is it more involved?

If someone purchase IPs from RIPE, ARIN etc. do they provide their own location data and if it is designated for datacenter, home usage etc.?

  • Mind corner cases where the distinction is not strictly possible, such as IP ranges used in datacenters yet mainly tunneling traffic of home internet usage (masking the origin to access EU/US/CN media). – anx Jun 10 at 10:09
1

Grey area of big data. Combining all the open sources like RIPE and then buying data from the advertisers. The real fun starts if you are buying an IP space that was previously used for clients in France and now you use it in Germany. Now tell Google&Co to show google.de instead of google.fr. Or try to run a mailserver in such IP space with bad reputation, have fun sending mail to gmail or o365. Spoiler: impossible, get a new IP space.

0

Every IP resides in a block of IPs assigned to a single entity, either an ISP or an end user. In RIPE (the European IP registry) these blocks are known as INETNUM objects and they are easy to query using the RIPE database.

Here is the response for IP 212.58.244.26:

inetnum:         212.58.244.0 - 212.58.244.255
netname:         BBC-TELHC-WWW-1
country:         GB
descr:           BBC
descr:           Telstra London Hosting Centre
descr:           *******************************************************
descr:           * In case of any problems with users of this address
descr:           * space (spam, attacks, illegal activity, etc) please
descr:           * email abuse@bbc.co.uk with full logfile entries
descr:           *******************************************************
remarks:         Abuse reports to abuse@bbc.co.uk
remarks:         INFRA-AW
admin-c:         BBC-RIPE
tech-c:          BBC-RIPE
status:          ASSIGNED PA
mnt-by:          BBC-MNT
created:         2017-03-02T10:31:19Z
last-modified:   2017-03-02T10:31:19Z
source:          RIPE

There are various ways you could parse this response to determine more information about the IP, but it will rarely be completely definitive. For instance, we can see above a country code (GB) and we could use the RIPE database to look up the role holder (BBC-RIPE). This role holder contains a valid address (BBC Broadcasting House, Portland Place, LONDON, W1A 1AA). In addition, there is plain text in the record asserting that the block is used in a London data centre. Firms like MaxMind will use this data and their own algorithms to try to provide sensible data.

RIPE provide a selection of useful information about a block using, in this example, the link https://stat.ripe.net/212.58.244.0%20-%20212.58.244.255#tabId=at-a-glance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.