Recipe 8.10. Tracking and Blocking Visitors Based on Their IP Numbers

Problem

You need to determine the geographic location or Internet service provider of a visitor, possibly because you suspect he is attempting to abuse or defraud your site.

Solution

Make a note of the visitor's IP number, and then submit the IP number as a query to the American Registry for Internet Numbers (ARIN) whois search form at http://www.arin.net/whois.

Discussion

IP numbers are unique identifiers for every machine connected to the Internet. They take the form of a dotted quadfour numbers between 0 and 255 separated by periods. For example, my PC's IP number is 70.113.31.107.

You should be able to get the IP number of a visitor from your web server access log or from your online store transaction records. If you receive an email from a visitor and can view the message header information with your email client, you might be able to get an IP number that way, too.

Search results from the ARIN database should supply you with the name, address, and phone number of the owner of the IP number (typically, the IP address belongs to an Internet service provider, not the end user). If the number is not in the ARIN registry, the results page might refer you to another regional registry where you can try another search. With this information, you can contact the ISP and report the suspicious activity.

You also might want to deny the visitor access to your site by blocking his IP number. Adding a few lines to an .htaccess file in your web site's root directory will prevent a specific IP number from accessing your web site:

 <Limit GET POST> order allow,deny allow from all deny from 70.113.31.107 </Limit> 

To block a group of similar IP addressessince dialup accounts usually get a different IP for each online sessionleave off the last dot and quad:

 <Limit GET POST> order allow,deny allow from all deny from 70.113.31 </Limit> 

This rule will block all 256 possible IP numbers between 70.113.31.0 and 70.113.31.255. Bear in mind when using this technique that when you deny large groups of IP addresses, you stand a good chance of blocking legitimate access to your site.

See Also

The Net World Map project web site provides some additional geographic information for IP numbers searched against their database (at http://www.geobytes.com/IpLocator.htm), but the results can be sketchyand the site design is cheesy.