I had a suspicious IP pop up yesterday, but when I run a traceroute on it I get some *wierd* results...would some of y'all mind running it and seeing where it ends up? Here it is:

12.77.162.214

When I trace it, it never seems to terminate at the originating IP like other IPs I've traced...I have to keep tracing the last IP in the traceroute, which takes about 5 tries, until I finally get to a final IP. Am I doing this incorrectly, or is something odd happening?

looks like it comes from Winter Haven Florida?

this is what i get.

12.77.162.214 = [ 214.knoxville-01-03rs.tn.dial-access.att.net ]
OrgName: AT&T WorldNet Services
OrgID: ATTW
Address: AT&T
Address: 200 S. LAUREL AVE.
City: MIDDLETOWN
StateProv: NJ
PostalCode: 07748
Country: US
NetRange: 12.0.0.0 - 12.255.255.255
CIDR: 12.0.0.0/8
NetName: ATT
NetHandle: NET-12-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: DBRU.BR.NS.ELS-GMS.ATT.NET
NameServer: DMTU.MT.NS.ELS-GMS.ATT.NET
NameServer: CBRU.BR.NS.ELS-GMS.ATT.NET
NameServer: CMTU.MT.NS.ELS-GMS.ATT.NET
Comment: For abuse issues contact [][email protected][/]
RegDate: 1983-08-23
Updated: 2002-08-23
TechHandle: DK71-ARIN
TechName: Kostick Deirdre
TechPhone: 1-919-319-8249
TechEmail: [][email protected][/]
OrgAbuseHandle: ATTAB-ARIN
OrgAbuseName: ATT Abuse
OrgAbusePhone: 1-919-319-8130
OrgAbuseEmail: [][email protected][/]
OrgTechHandle: ICC-ARIN
OrgTechName: IP Customer Care
OrgTechPhone: 1-888-613-6330
OrgTechEmail: [][email protected][/]
OrgTechHandle: IPSWI-ARIN
OrgTechName: IP SWIP
OrgTechPhone: 1-888-613-6330
OrgTechEmail: [][email protected][/]
CustName: AT&T Worldnet Services
Address: 412 Mount Kemble Ave.
Address: P.O. Box 1995
City: Morristown
StateProv: NJ
PostalCode: 07962
Country: US
RegDate: 2003-10-15
Updated: 2003-10-15
NetRange: 12.77.0.0 - 12.77.255.255
CIDR: 12.77.0.0/16
NetName: ATTSVC-12-77-0-0
NetHandle: NET-12-77-0-0-1
Parent: NET-12-0-0-0-1
NetType: Reassigned
Comment: Contact AT&T Abuse ( [][email protected][/] ) for policy abuse issues.
RegDate: 2003-10-15
Updated: 2003-10-15
TechHandle: DK71-ARIN
TechName: Kostick Deirdre
TechPhone: 1-919-319-8249
TechEmail: [][email protected][/]
OrgAbuseHandle: ATTAB-ARIN
OrgAbuseName: ATT Abuse
OrgAbusePhone: 1-919-319-8130
OrgAbuseEmail: [][email protected][/]
OrgTechHandle: ICC-ARIN
OrgTechName: IP Customer Care
OrgTechPhone: 1-888-613-6330
OrgTechEmail: [][email protected][/]
OrgTechHandle: IPSWI-ARIN
OrgTechName: IP SWIP
OrgTechPhone: 1-888-613-6330
OrgTechEmail: [][email protected][/]
ARIN WHOIS database last updated 2005-05-11 19: 10
Enter ? for additional hints on searching ARIN's WHOIS database.


I use http://www.infosyssec.com/infosyssec/ipsectools.htm

Whenever I want to check out an IP, my first step is ping -a rather than traceroute. It's usually a quick way to find out where the IP is from.

Another good site to use would be http://www.dnsstuff.com