Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I did an IP lookup this morning to trace its origins based on an email I received. Within a section labeled 'Whois Domain Info', it reads the following:

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to for detailed information.




Now I realize this is one of Comcast's IPs and I have replaced the actual text with 'EXAMPLE.COM'. My question is related to what 'COMCAST.NET.EXAMPLE.COM' is supposed to represent. How does the IP I looked up relate to in this case?


share|improve this question
Though not your question, Suma is right about SpamCop. That makes me wonder what you actually did. You got some IP, then got the name out of that (maybe just a ping?), and then did a whois That explains you're seeing the thing that I believe is Whois Spam. No need to protect -- they are abusing the internet alright. Or did you do something else? – Arjan Jan 19 '10 at 16:23

I guess it's just Whois Spam by

See How to use command line whois for “spam infected” domains like here at Super User.

share|improve this answer

For the purpose of tracking source of email I would highly recommend - it can parse mail headers in a lot more reliable way than most of us can.

As for addresses like COMCAST.NET.EXAMPLE.COM, this is actually NOT a comcast IP. It is just an IP which attempts to look like a comcast one. If tracking the real owner, you always need to process the address from the end.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.