Reverse identify a company by IP?

[howartp]

Hi,

 

An iPad which belongs to an unidentified former employee is spending its daytime hours online at a business area of Leeds (as shown in our iPad MDM), but we don't know who the person is. Usually when we register a device, we allocate it to a person on the MDM, but as this is a personal device rather than school-owned, we seem to have missed this step.

 

I have the public IP address of the company's internet access - 86.186.193.140 - which is a BT-issued IP; does anyone know of a way of tracing which company in that area this belongs to?

 

I've tried a reverse ping (-a) on the domain name of two of the companies in the area, neither of which match; any other suggestions? (It's not densely populated; it's an outer area of Leeds)

 

I know that residential IP addresses don't necessarily give away their location by IP address because maps show the head office of the ISP, but I can't see any BT offices around this location.

 

Peter

[jamesb]

If it's a personal device, shouldn't you just remove it from the MDM?

 

It's a BT wholesale address which suggests a business. A handful of non-http services running on the address which would imply a company proxy/remote-access solution.

 

If you've got the company names I'd recommend querying the MX records to see if they might match.

[howartp]

If it's a personal device, shouldn't you just remove it from the MDM?

Yes, but doing so will remove all our apps from it - I want to give them opportunity to backup any data in the apps first. (They can still re-install the apps from the app store and restore the data if backed up)

 

A handful of non-http services running on the address which would imply a company proxy/remote-access solution.

Thanks; I never even thought about trying to browse the IP via HTTP, never mind scanning it for other ports.

 

If you've got the company names I'd recommend querying the MX records to see if they might match.

That's a good idea; I'll give that a go.

 

Cheers.

[jamesb]

Not sure whether this is helpful or not, but the address is on the following blacklists:

 

- BARRACUDA

- SEM BLACK

- SORBS DUHL

- SORBS SPAM

- Spamhaus ZEN

 

Having looked into it a little more it may well be a residential account with a RIPE address attached. Either way it seems to be compromised in some form and used as an e-mail relay.

[nathan]

Could you not send a message to the iPad via the MDM solution?

[howartp]

Could you not send a message to the iPad via the MDM solution?

 

Sadly the MDM app isn't on / failed to install - I have resent it but they are either declining it (intentionally or otherwise) or it still isn't working/failing.

[pooley]

You have tried your best to help the former employee out by installing the mdm app remotely, if they can't/won't authorize it just remove it from your mdm solution and let them pick up the pieces. Or ask your office admin staff if they have a mobile number for him?

[howartp]

Not sure whether this is helpful or not, but the address is on the following blacklists:

 

- BARRACUDA

- SEM BLACK

- SORBS DUHL

- SORBS SPAM

- Spamhaus ZEN

 

Having looked into it a little more it may well be a residential account with a RIPE address attached. Either way it seems to be compromised in some form and used as an e-mail relay.

That doesn't actually surprise me based on the name / industry practices of one of the companies I've found - which is the same reason I haven't tried ringing them to ask.

[howartp]

You have tried your best to help the former employee out by installing the mdm app remotely, if they can't/won't authorize it just remove it from your mdm solution and let them pick up the pieces. Or ask your office admin staff if they have a mobile number for him?

 

We don't know who it is unfortunately, other than someone who must have been through our office for us to register him/her.

 

Peter