untangling_the_web

DID: 4046925
UNCLA55IFIEDl1'F6R 6FFlel)!(L USE 6NL'f
Of special note are the two IP addresses that appear in these records as mail
servers: 195.128.64.9 and 212.5.80.6. The first resolves to Macomnet in Moscow
and the second to kaspersky.com, a domain name registered with Tucows.com.
Sounds like it might be in the US.
4. Where is kaspersky.com or 212.5.80.6 physically located?
This is usually harder to determine because truly accurate geolocation tools are not
available for free on the Internet. However, we can get some pretty good clues from
the network analysis tool traceroute. Below is the traceroute to kaspersky.com using
Domain Dossier. Notice in particular the last three hops before reaching 212.5.80.6:
they are Frankfurt, Germany (frankfurt1.de.alter.net), Moscow (msk.macomnet.net),
and Macomnet's address 195.128.64.9 in Moscow. Traceroute shows the name of
routers along the path the data is traveling, and these routers frequently (but
certainly not always) use airport codes (e.g. LON, ATL). Below, for example,
dca4.alter.net is almost certainly in the Washington, DC, area. There is much more
that can be learned from traceroutes, a topic covered in the next section.
Tracercute
Tracing route to st.kesperskv.eom [212.5.80.6]...
hop rti rtt rtt 'ip,address fully qual,ified domainriame
1 0 0 1 216.46.228.229 port-216-3073253-e5128 .devicss .dstarsturn.corn
2 0 0 a 64,29,192,145 POft-64-1949841-2ztooresoect.devices .datarsturnmIT
3 0 0 0 54.29.192.226 daa.g921.isob .datareturn.com
4 0 0 0 168,215.241,133 hagg-Ol-aeO-1iJ01.dlfw rwtelscom.net
5 o a 0 65.192.253,124 core-02-