On 17 Jun 2012, at 20:29, Owen DeLong wrote:
Lather rinse repeat with a better choice of address...
2001:550:3ee3:f329:102a3:2aff:fe23:1f69
This is in the ARIN region...
It's from within a particular ISP's /32.
Has that ISP delegated some overlapping fraction to another ISP? If so, it's not in whois. Have they delegated it to an end user? Again, if so, it's not in whois.
Same for 2001:550:10:20:62a3:3eff:fe19:2909
I don't honestly know if either of those prefixes is allocated or not, so maybe nothing's wrong in this particular case, but if they have been delegated and not registered in whois, that's a real problem when it comes time to get a search warrant if speed is of the essence.
Owen
Not being in the whois is not an indicator that the ISP (to whom the address block has been delegated) does not know about which customer has an IP (v4 or v6, doesn't matter). I have seen tons of ISPs that do not publish delegations in the whois but have a huge excel worksheets where they record every suballocation. You just need a warrant to see that info. Ergo, the FBI, interpol or you name it should not have problem to get them. /as