Editing Encyclopedia:Vandalism (section)

==Tracing IP addresses==
{{Policy shortcut|WP:WHOIS|WP:TRACEIP}}
The owners of [[IP address]]es can be found using:
* [https://whois.arin.net/ui ARIN] (North America)
* [https://stat.ripe.net/widget/whois RIPE NCC] (Europe, the Middle East and Central Asia)
* [https://www.apnic.net/apnic-info/whois_search APNIC] (Asia Pacific)
* [https://lacnic.net/cgi-bin/lacnic/whois LACNIC] (Latin American and Caribbean)
* [https://www.afrinic.net AfriNIC] (Africa)
* [https://www.ipligence.com/geolocation/?lang=en&search# IPLigence]
* [https://www.ipaddress.com/ ipaddress.com]
* [https://www.find-ip-address.org Find-IP-address.org]
* [https://who.is/ who.is]
If an address is not in one registry, it will probably be in another.

===Identifying associated IP addresses===

<!-- Useful though possibly overly advanced options, trying to strike a balance between "useful" and "off into the weeds". -->

If you're trying to determine whether a {{em|set}} of IP addresses involved in vandalism is related, a command-line WHOIS query will generally list this information, or can be shown using the [http://www.routeviews.org Routeviews] [[Domain Name System|DNS]] [[name server]] asn.routeviews.org reverse [[IP address|IP]] look-up to find the [[Classless Inter-Domain Routing|CIDR]] and [[Autonomous system (Internet)|ASN]] for a set of IP addresses. This can be done using [[IP address#Diagnostic tools|IP lookup tools]].

A [[Whois#Query example|WHOIS query]] will typically return NetRange, CIDR, NetName, NetHandle, and OriginAS, all of which identify specific network spaces. Data and labeling vary considerably by WHOIS registrar.

The Routeviews data is far more uniformly structured and returns ASN and CIDR as a reverse-lookup TXT query result. It is more useful and faster than WHOIS when checking multiple IP addresses and can be scripted or automated.

CIDR identifies a set of related addresses ("network space") and ASN identifies an [[Autonomous system (Internet)|Autonomous System]]—that is, a single administrative entity with control over multiple (and often very many) addresses. Some (though not all) abuse from multiple sources does come from such unified spaces—possibly corresponding to a set of hosts within a single facility.

Abuse originating in a short period of time from different IP addresses within the same CIDR or ASN may indicate a dedicated non-distributed attack, as opposed to a [[Denial-of-service attack#Distributed attack|distributed denial of service attack]].

===Proxies, VPNs and Tor exit nodes===

It's possible that a user's source location is being masked by routing traffic through a [[Proxy server]], [[VPN]] or the [[Tor (network)|Tor network]]. Such addresses typically serve many, not just one, person, and though they can be valid present challenges when used for abuse.

A proxy VPN is not necessarily detectable, but commercial services may be indicated by the hostname when resolving an IP address.

Users of the Tor anonymity network will show the IP address of a Tor "exit node". Lists of known Tor exit nodes are available from the Tor Project's [https://check.torproject.org/cgi-bin/TorBulkExitList.py Tor Bulk Exit List exporting tool].