We recently received some web visits from IP address 204.250.156.30.
This IP address is registered to I-STAR ONLINE. I'd like to know the
city and state of the actual user (not I-Star).

---

Clarification of Question by bonnyman-ga on 31 Oct 2002 11:27 PST

Thanks for the comments so far. 

I have already run a Traceroute and done a Whois search using the
Network Utility built into MacOS X (I think these are actually Unix
commands given a graphical front end by Apple but I'm not sure).

The problem with OS X's traceroute was that the responses were so
cryptic I couldn't decypher them.

Whois confirmed that the IP address was registered to I-Star. Since
I-Star has such a big footprint in Michigan, I'm interested in knowing
just which of the many dial-up points they have was used for our web
visits.

---

Clarification of Question by bonnyman-ga on 31 Oct 2002 15:55 PST

My question is based on mere curiosity; the visitor was referred to
our web site based on a search for a very unusual search phrase.

There was nothing untoward (spamming, abuse, etc.) associated with
this visitor.

Hi bonnyman,

  Good day and thanks for your question.

  Although it is virtually impossible to find out the city of an IP
over the internet, I can confirm that the IP belongs to Oscada,
Michigan.

  The other day, I was chatting to a person on IRC with a similar IP
202.250.156.xxx, and she said that she was in Oscada, Michigan. IPs
for a city vary only in the fourth block. So, Generally, all IPs
falling in the 202.250.156.xxx category belong to Oscada, Michigan.

  The tool mentioned by pinkfreud is an excellent tool. Kudos to pink
for that!

  I hope this answers your question. If you have any clarifications,
then please don't hesitate to ask.

  Thank you for using this service and have a nice day


Warm Regards,
Aditya2K

You can use this website, http://www.sarangworld.com/TRACEROUTE/ , to
run a traceroute on that IP.  It does lose it around Chicago, IL where
the IP goes from a standard Sprint IP to a IP range that is owned by
the business.

Check out the following address
http://www.i-star.com/support/access-numbers.html to see what area
codes are provided with dial-in numbers. It appears that I-Star
services most of Michigan, including the upper penninsula.

A WHOIS query on i-star.net yields the following:
Registrant: 
I-STAR ONLINE (I-STAR2-DOM) 
5738 N. F-41 
Oscoda 
MI,48750 
US 

Domain Name: I-STAR.NET 

Administrative Contact, Technical Contact: 
Morris, Dean (DM237) istaronline@YAHOO.COM 
I-STAR ONLINE, Inc. 
5738 North F-41 
Oscoda, MI 48750 
US 
989-739-3552 517-739-8913 

Record expires on 20-Jan-2003. 
Record created on 18-Jan-1997. 
Database last updated on 31-Oct-2002 13:12:02 EST. 

Domain servers in listed order: 

DNS1.I-STAR.NET 204.250.156.2 
DNS2.I-STAR.NET 204.250.156.3

When I entered this IP into the Net World Map project, it gave a
response (with 66% certainty) that the location was Oscoda, Michigan.

http://www.networldmap.com/TryIt.htm

Once you've tracked it down to a particular ISP, the only way you can
narrow it further (reliably) would be to determine if the IP is a
dialup connection or a dedicated IP address.

If it's a dynamically allocated IP, then it will be relatively
difficult to track it down without cooperation from the ISP in
question. Is this in regard to an attack or defacement of some sort?
(That would constitute a criminal offense; the
police/fbi/what-have-you will have more leverage over the ISP to find
out who's behind the computer that it was done from.)

If it WAS an attack or defacement, it's likely that the computer at
that IP address is simply vulnerable, by an open proxy server or a
backdoor program of some sort, and most desktop machines do not log
TCP/IP traffic well enough for you to determine where it was -really-
being done from.

If it's simple curiosity, the closest you will be able to narrow it
down to would be the service area that the ISP covers..and if it's
dialup, then it could still be a long-distance dialup, from
(theoretically) anywhere in the world.

The Net World Map link posted in comments earlier is your best bet for
an educated guess, however.

-brightshadow