Re: Grabbing information when all you have is the IP

Thomas G. Marshall wrote:


Oh I understand that part (thanks anyway) but I supplied that info,
and that I was doubly mystified, only because I was unsure if there
was some backdoor
way into the OS and system information that I was unaware of. Because
this is unlikely to be using some OS originated communication, it
would require port forwarding, which I use on only 2 ports.

The notion that there is a data collection out there matching IP's to
locations seems to solve the mystery and pull sanity back into the
loop. :) The two links you provided me below are helpful (thanks) but
I am still
wondering how they got my town name. The information from those links
supplied just yields at best vague regions. My IP dynamic from
verizon, so unless there is a specific region just for my little town,
I am still wondering how they got this info, unless, of course, my PC
is infected and actively sending my information to some mother ship.

Really, as I said there is nothing mystifying about it. Right now your
headers show your IP as 70.19.xxx.xxx (numbers "x"d out to make you
feel more secure - although they show clearly on your headers,
naturally). If I plug your IP address into the whois on
www.dnsstuff.com, this is what I get:

OrgName: Verizon Internet Services Inc.
OrgID: VRIS
Address: 1880 Campus Commons Dr
City: Reston
StateProv: VA
PostalCode: 20191
Country: US

NetRange: 70.16.0.0 - 70.23.255.255
CIDR: 70.16.0.0/13
NetName: VIS-70-16
NetHandle: NET-70-16-0-0-1
Parent: NET-70-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.BELLATLANTIC.NET
NameServer: NS2.BELLATLANTIC.NET
NameServer: NS2.VERIZON.NET
NameServer: NS4.VERIZON.NET
Comment: Please send all abuse reports to *****@verizon.net.
Comment: DO NOT send e-mail to *********@verizon.com as it will not
be answered.
RegDate: 2004-03-30
Updated: 2005-04-21

RNOCHandle: ZV20-ARIN
RNOCName: Verizon Internet Services
RNOCPhone: +1-703-295-4583
RNOCEmail: *****@gnilink.net

OrgAbuseHandle: VISAB-ARIN
OrgAbuseName: VIS Abuse
OrgAbusePhone: +1-214-513-6711
OrgAbuseEmail: *****@verizon.net

OrgTechHandle: ZV20-ARIN
OrgTechName: Verizon Internet Services
OrgTechPhone: +1-703-295-4583
OrgTechEmail: *****@gnilink.net

So the website you went to has some code that picks up what towns that
range of IP addresses covers or something like that and you get an ad
targeted to Reston (or thereabouts). No big deal.

Look at my headers from this post and do the same with my IP address and
you'll get my location as Fresno, California (which it is). If I went
to the website, I'd undoubtedly get ads targeted to Fresno. Naturally I
wouldn't be concerned because I'm well protected. (And I'm running
Linux.) ;-)

Don't get all exercised about this. As I said before, this is just a web
trick. If you are properly protected, there's nothing to worry about.
If you're really concerned, run through my general malware removal
steps:

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Malke
--
MS-MVP Windows User/Shell
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"
.

Relevant Pages