I en whois database (for eksempel Geek Tools) indsætter du afsenders IP-adresse i søgefeltet, og trykker på ok
Eksempel: Indtaster du f.eks. 193.163.158.1 svarer whois databasen følgende:
% This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html
inetnum: 193.163.158.0 - 193.163.159.255
netname: TD-INTERNET-NET
descr: Tele Danmark Internet
descr: IP-pool for hosting
descr: Aarhus
country: DK
admin-c: TDI1-RIPE
tech-c: TDI1-RIPE
status: ASSIGNED PI
notify: staff@ip.tele.dk
mnt-by: TDK-MNT
changed: /c=dk/a=dk400/p=diatelintern/s=villemoes/g=harald/@x400.denet.dk 19950421
changed: netpasser-robert@dknet.dk 19950421
changed: auto-ripe@ip.tele.dk 19971211
changed: netpasser-robert@DK.net 19980313
changed: auto-ripe@ip.tele.dk 20010311
source: RIPE
route: 193.163.158.0/23
descr: Tele Danmark Internet
origin: AS3292
mnt-by: AS3292-MNT
remarks: +---------------------------------------+
remarks: | For abuse and security issues contact |
remarks: | csirt@csirt.dk, http://www.csirt.dk |
remarks: +---------------------------------------+
changed: auto-ripe@ip.tele.dk 19990218
changed: auto-ripe@ip.tele.dk 20010816
source: RIPE
role: TeleDanmark Internet
address: Tele Danmark DataNet
address: Sletvej 30, A039
address: DK-8310 Tranbjerg
address: Denmark
phone: +45 50 12 29 47
e-mail: staff@ip.tele.dk
trouble: staff@ip.tele.dk
admin-c: JS4261-RIPE
tech-c: JS4261-RIPE
tech-c: TB15-RIPE
tech-c: NCB1-RIPE
tech-c: HV72-RIPE
nic-hdl: TDI1-RIPE
mnt-by: AS3292-MNT
changed: netpasser-robert@DK.net 19970904
changed: netpasser-robert@DK.net 19970922
changed: netpasser-robert@DK.net 19980107
changed: auto-ripe@ip.tele.dk 19990730
changed: auto-ripe@ip.tele.dk 19990905
source: RIPE
Den information du så skal bruge, finder du i feltet remarks.
I dette tilfælde er mailadressen csirt@csirt.dk.
Du kan nu sende mail-headeren til denne adresse. Sådan gør du.