Finding the address

For a website, query A and AAAA records. For an email, read the Received headers of the original message to find the IP address that handed the message to the recipient’s server. Record the time, because addresses change.

Who holds the address

Regional Internet Registries (RIPE NCC, ARIN, APNIC, LACNIC, AFRINIC) publish RDAP data on who holds an address block. URL Forensics routes each lookup to the correct registry using IANA bootstrap data. The holder is usually a hosting company, cloud provider or ISP, not the person running the site.

Interpreting results

Content delivery networks and proxies hide the origin server. Shared hosting places many unrelated sites on one address. Use IP evidence to identify the provider to contact or subpoena, not to name an operator.

  • Record IP, source record and UTC time.
  • Identify the RIR and network holder.
  • Check for CDN or proxy use.
  • Contact the provider’s abuse desk with precise evidence.

Sources and further reading

IANA, RDAP bootstrapRIPE NCC, RIPE Database
This resource supports investigative triage. It is not legal advice, an attribution finding or a certification that a website is safe.
All forensic resources