PCT
`INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT)
`WO 00/67450
`
`WORLD INTELLECTUAL PROPERTY ORGANIZATION
`International Bureau
`
`(51) International Patent Classification 7 :
`H04L 29/12, 29/06, 12/24
`
`(11) International Publication Number:
`
`Al
`
`(43) International Publication Date:
`
`9 November 2000 (09.11.00)
`
`(21) International Application Number:
`
`PCT/US00/11803
`
`(22) International Filing Date:
`
`2 May 2000 (02.05.00)
`
`(30) Priority Data:
`60/132,147
`60/133,939
`09/541,451
`
`3 May 1999 (03.05.99)
`13 May 1999 (13.05.99)
`31 March 2000 (31.03.00)
`
`us
`us
`us
`
`(71) Applicant: DIGITAL ENVOY, INC. [US/US]; Suite 100, 4500
`River Green Parkway, Duluth, GA 30096 (US).
`
`(72) Inventors: PAREKH, Sanjay, M.; 3333 Willbridge Court,
`Duluth, GA 30096 (US). FRIEDMAN, Robert, B.; 1405
`Crescent Walk, Decatur, GA 30033 (US). TIBREWALA,
`Neal, K.; 5523 Howe Street, Apt. 3, Pittsburgh, PA 15232
`(US). LUTCH, Benjamin; 660 Leona Lane, Mountain View,
`CA 94040 (US).
`
`(74) Agents: PRATT, John, S. et al.; Kilpatrick Stockton LLP, Suite
`2800, 1100 Peachtree Street, Atlanta, GA 30309-4530 (US).
`
`(81) Designated States: AE, AG, AL, AM, AT, AU, AZ, BA, BB,
`BG,BR, BY,CA,CH, CN,CR,CU,CZ, DE,DK,DM,
`DZ, EE, ES, FI, GB, GD, GE, GH, GM, HR, HU, ID, IL,
`IN, IS, JP, KE, KG, KP, KR, KZ, LC, LK, LR, LS, LT, LU,
`LV, MA, MD, MG, MK, MN, MW, MX, NO, NZ, PL, PT,
`RO, RU, SD, SE, SG, SI, SK, SL, TJ, TM, TR, TT, TZ,
`UA, UG, UZ, VN, YU, ZA, ZW, ARIPO patent (GH, GM,
`KE, LS, MW, SD, SL, SZ, TZ, UG, ZW), Eurasian patent
`(AM, AZ, BY, KG, KZ, MD, RU, TJ, TM), European patent
`(AT, BE, CH, CY, DE, DK, ES, FI, FR, GB, GR, IE, IT,
`LU, MC, NL, PT, SE), OAPI patent (BF, BJ, CF, CG, CI,
`CM, GA, GN, GW, ML, MR, NE, SN, TD, TG).
`
`Published
`With international search report.
`Before the expiration of the time limit for amending the
`claims and to be republished in the event of the receipt of
`amendments.
`
`(54) Title: SYSTEMS AND METHODS FOR DETERMINING, COLLECTING, AND USING GEOGRAPHIC LOCATIONS OF
`INTERNET USERS
`
`(57) Abstract
`
`A method of determining a geographic
`location of an Internet user involves deter(cid:173)
`mining if the host is on-line, determining
`ownership of the host name, and then deter(cid:173)
`mining the route taken in delivering packets
`to the user. Based on the detected route, the
`method proceeds with determining the geo(cid:173)
`graphic route based on the host locations and
`then assigning a confidence level to the as(cid:173)
`signed location. A system collects the geo(cid:173)
`graphic information and allows web sites or
`other entities to request the geographic loca(cid:173)
`tion of their visitors. The database of geo(cid:173)
`graphic locations may be stored in a central
`location or, alternatively, may be at least par(cid:173)
`tially located at the web site. With this infor(cid:173)
`mation, web sites can target content, adver(cid:173)
`tising, or route traffic depending upon the ge(cid:173)
`ographic locations of their visitors. Through
`web site requests for geographic information,
`a central database tracks an Internet user's
`traffic on the Internet whereby a profile can
`be generated. In addition to this profile, the
`central database can store visitor's prefer(cid:173)
`ences as to what content should be delivered
`to an IP address, the available interface, and
`the network speed associated with that IP ad(cid:173)
`dress.
`
`32 ,-----&.---.
`INTERMEDIATE
`HOST
`
`34
`
`NEWTARGET
`HOST
`
`10
`
`COLLECTION
`SYSTEM
`
`20
`
`LOCATION
`DATABASE
`
`
`
`
`Twitter Exhibit 1025
`Twitter, Inc. v. BlackBerry Ltd.
`Page 00000
`
`

`

`FOR THE PURPOSES OF INFORMATION ONLY
`
`Codes used to identify States party to the PCT on the front pages of pamphlets publishing international applications under the PCT.
`
`AL
`AM
`AT
`AU
`AZ
`BA
`BB
`BE
`BF
`BG
`BJ
`BR
`BY
`CA
`CF
`CG
`CH
`CI
`CM
`CN
`cu
`CZ
`DE
`DK
`EE
`
`Albania
`Armenia
`Austria
`Australia
`Azerbaijan
`Bosnia and Herzegovina
`Barbados
`Belgium
`Burkina Faso
`Bulgaria
`Benin
`Brazil
`Belarus
`Canada
`Central African Republic
`Congo
`Switzerland
`Ct>te d'Ivoire
`Cameroon
`China
`Cuba
`Czech Republic
`Germany
`Denmark
`Estonia
`
`ES
`FI
`FR
`GA
`GB
`GE
`GH
`GN
`GR
`HU
`IE
`IL
`IS
`IT
`JP
`KE
`KG
`KP
`
`KR
`KZ
`LC
`LI
`LK
`LR
`
`Spain
`Finland
`France
`Gabon
`United Kingdom
`Georgia
`Ghana
`Guinea
`Greece
`Hungary
`Ireland
`Israel
`Iceland
`Italy
`Japan
`Kenya
`Kyrgyzstan
`Democratic People's
`Republic of Korea
`Republic of Korea
`Kazakstan
`Saint Lucia
`Liechtenstein
`Sri Lanka
`Liberia
`
`LS
`LT
`LU
`LV
`MC
`MD
`MG
`MK
`
`ML
`MN
`MR
`MW
`MX
`NE
`NL
`NO
`NZ
`PL
`PT
`RO
`RU
`SD
`SE
`SG
`
`Lesotho
`Lithuania
`Luxembourg
`Latvia
`Monaco
`Republic of Moldova
`Madagascar
`The former Yugoslav
`Republic of Macedonia
`Mali
`Mongolia
`Mauritania
`Malawi
`Mexico
`Niger
`Netherlands
`Norway
`New Zealand
`Poland
`Portugal
`Romania
`Russian Federation
`Sudan
`Sweden
`Singapore
`
`SI
`SK
`SN
`sz
`TD
`TG
`TJ
`TM
`TR
`TT
`UA
`UG
`us
`uz
`VN
`YU
`zw
`
`Slovenia
`Slovakia
`Senegal
`Swaziland
`Chad
`Togo
`Tajikistan
`Turkmenistan
`Turkey
`Trinidad and Tobago
`Ukraine
`Uganda
`United States of America
`Uzbekistan
`Viet Nam
`Yugoslavia
`Zimbabwe
`
`Page 00000.1
`
`

`

`WO 00/67450
`
`PCT/US00/11803
`
`SYSTEMS AND METHODS FOR DETERMINING, COLLECTING, AND USING
`GEOGRAPHIC LOCATIONS OF INTERNET USERS
`
`5
`
`CROSS-REFERENCE TO RELATED APPLICATIONS
`
`This application claims priority to, and incorporates by reference, U.S. Application
`
`Serial No. 60/132,147 entitled "System to Determine the Geographic Location of an Internet
`
`User" filed on May 3, 1999, and U.S. Application Serial No. 60/133,939 entitled "Method,
`
`System and Set of Programs for Tailoring an Internet Site Based Upon the Geographic
`
`10
`
`Location or Internet Connection Speed of Internet User" filed on May 13, 1999.
`
`FIELD OF THE INVENTION
`
`The present invention relates to systems and methods for determining geographic
`
`15
`
`locations of Internet users. According to other aspects, the invention relates to systems and
`
`methods for collecting geographic locations of Internet users, for profiling Internet users, or
`
`for selectively delivering information based on the geographic locations or connection speeds
`
`of the Internet users.
`
`20
`
`BACKGROUND
`
`The Internet consists of a network of interconnected computer networks. Each of
`
`these computers has an IP address that is comprised of a series of four numbers separated by
`
`periods or dots and each of these four numbers is an 8-bit integer which collectively
`
`represent the unique address of the computer within the Internet. The Internet is a packet
`
`1
`
`Page 00001
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`switching network whereby a data file routed over the Internet to some destination is broken
`
`down into a number of packets that are separately transmitted to the destination. Each packet
`
`contains, inter alia, some portion of the data file and the IP address of the destination.
`
`The IP address of a destination is useful in routing packets to the correct destination
`
`5
`
`but is not very people friendly. A group of four 8-bit numbers by themselves do not reveal or
`
`suggest anything about the destination and most people would find it difficult to remember
`
`the IP addresses of a destination. As a result of this shortcoming in just using IP addresses,
`
`domain names were created. Domain names consist of two or more parts, frequently words,
`
`separated by periods. Since the words, numbers, or other symbols forming a domain name
`
`10
`
`often indicate or at least suggest the identity of a destination, domain names have become the
`
`standard way of entering an address and are more easily remembered than the IP addresses.
`
`After a domain name has been entered, a domain name server (DNS) resolves the domain
`
`name into a specific IP address. Thus, for example, when someone surfing the Internet enters
`
`into a browser program a particular domain name for a web site, the browser first queries the
`
`15 DNS to arrive at the proper IP address.
`
`While the IP address works well to deliver packets to the correct address on the
`
`Internet, IP addresses do not convey any useful information about the geographic address of
`
`the destination. Furthermore, the domain names do not even necessarily indicate any
`
`geographic location although sometimes they may suggest, correctly or incorrectly, such a
`
`20
`
`location. This absence of a link between the IP address or domain name and the geographic
`
`location holds true both nationally and internationally. For instance, a country top-level
`
`2
`
`Page 00002
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`domain format designates .us for the United States, .uk for the United Kingdom, etc. Thus,
`
`by referencing these extensions, at least the country within which the computer is located can
`
`often be determined. These extensions, however, can often be deceiving and may be
`
`inaccurate. For instance, the .md domain is assigned to the Republic of Moldova but has
`
`5
`
`become quite popular with medical doctors in the United States. Consequently, while the
`
`domain name may suggest some aspect of the computer's geographic location, the domain
`
`name and the IP address often do not convey any useful geographic information.
`
`In addition to the geographic location, the IP address and domain name also tell very
`
`little information about the person or company using the computer or computer network.
`
`10 Consequently, it is therefore possible for visitors to go to a web site, transfer files, or send
`
`email without revealing their true identity. This anonymity, however, runs counter to the
`
`desires of many web sites. For example, for advertising purposes, it is desirable to target
`
`each advertisement to a select market group optimized for the goods or services associated
`
`with the advertisement. An advertisement for a product or service that matches or is closely
`
`15
`
`associated with the interests of a person or group will be much more effective, and thus more
`
`valuable to the advertisers, than an advertisement that is blindly sent out to every visitor to
`
`the site.
`
`Driven often by the desire to increase advertising revenues and to increase sales,
`
`many sites are now profiling their visitors. To profile a visitor, web sites first monitor their
`
`20
`
`visitors' traffic historically through the site and detect patterns of behavior for different
`
`groups of visitors. The web site may come to infer that a certain group of visitors requesting
`
`3
`
`Page 00003
`
`

`

`WO 00/67450
`
`PCT/US00/11803
`
`a page or sequence of pages has a particular interest. When selecting an advertisement for
`
`the next page requested by an individual in that group, the web site can target an
`
`advertisement associated with the inferred interest of the individual or group. Thus, the
`
`visitor's traffic through the web site is mapped and analyzed based on the behavior of other
`
`5
`
`visitors at the web site. Many web sites are therefore interested in learning as much as
`
`possible about their visitors in order to increase the profitability of their web site.
`
`The desire to learn more about users of the Internet is countered by privacy concerns
`
`of the users. The use of cookies, for instance, is objectionable to many visitors. In fact, bills
`
`have been introduced into the House of Representatives and also in the Senate controlling the
`
`10
`
`use of cookies or digital ID tags. By placing cookies on a user's computer, companies can
`
`track visitors across numerous web sites, thereby suggesting interests of the visitors. While
`
`many companies may find cookies and other profiling techniques beneficial, profiling
`
`techniques have not won wide-spread approval from the public at large.
`
`A particularly telling example of the competing interests between privacy and
`
`15
`
`profiling is when Double Click, Inc. of New York, New York tied the names and addresses
`
`of individuals to their respective IP addresses. The reactions to Double Click's actions
`
`included the filing of a complaint with the Federal Trade Commission (FTC) by the
`
`Electronic Privacy Information Center and outbursts from many privacy advocates that the
`
`tracking of browsing habits of visitors is inherently invasive. Thus, even though the
`
`20
`
`technology may allow for precise tracking of individuals on the Internet, companies must
`
`carefully balance the desire to profile visitors with the rights of the visitors in remaining
`
`4
`
`Page 00004
`
`

`

`WO 00/67450
`
`anonymous.
`
`PCT/US00/11803
`
`A need therefore exists for systems and methods by which more detailed information
`
`may be obtained on visitors without jeopardizing or compromising the visitors' privacy
`
`rights.
`
`5
`
`SUMMARY
`
`The invention addresses the problems above by providing systems and methods for
`
`determining the geographic locations of Internet users. According to one aspect, a method of
`
`collecting geographic information involves taking one of the IP address or host name and
`
`determining the organization that owns the IP address. Preferably, the method first takes one
`
`10
`
`of the IP address or host name and checks whether the host name is associated with that IP
`
`address, such as through an nslookup query. Next, the route to the host is acquired,
`
`preferably through a traceroute query, so as to determine a number of intermediate hosts.
`
`The specific route is analyzed and mapped against a database of stored geographic locations,
`
`thereby mapping out the intermediate hosts. For any intermediate host not having a location
`
`15
`
`stored in the database, the method involves determining a geographic location and storing
`
`this information in the database.
`
`According to another aspect, the invention relates to a system for determining
`
`geographic locations of Internet users. The determination system receives queries from
`
`requestors, such as web sites, for the geographic location of a certain Internet user. The
`
`20
`
`determination system in tum queries a central database of stored locations and returns the
`
`geographic information if contained in the database. If the geographic information is not in
`
`5
`
`Page 00005
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`the database, then the system performs a search to collect that information. Instead of
`
`querying a central database each time geographic location of an Internet user is desired, the
`
`web site or other requestor may have geographic locations of at least some Internet users
`
`stored in a local database. The web site first checks with the local database for the
`
`5
`
`geographic information and, if it not available, then sends a query to the central database.
`
`The geographic location information oflnternet users can be used for a variety of
`
`purposes. For instance, a position targeter can be associated with web sites to target the
`
`delivery of information based on the geographic location information. The web sites can
`
`selectively deliver content or advertising based on the geographic location of its visitors. The
`
`10
`
`geographic location information can also be used in the routing of Internet traffic. A traffic
`
`manager associated with a number of web servers detects the geographic locations of its
`
`Internet visitors and routes the traffic to the closest server.
`
`The databases of geographic locations can contain other information that may be
`
`useful to web sites and other requestors. The databases, for instance, can serve as a registery
`
`15
`
`for allowed content that may be delivered to a particular IP address or range of IP addresses.
`
`Thus, prior to a web site delivering content to an IP address, the web site may query the
`
`database to ensure that the delivery of the content is permitted. The databases may store
`
`network speeds of Internet users whereby a web site can tailor the amount of content
`
`delivered to an Internet user based in part of the bandwidth to that user. The databases may
`
`20
`
`also store an interface of an Internet user whereby a web site can tailor the content and
`
`presentation for that particular interface. Other uses of the geographic location and of the
`
`6
`
`Page 00006
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`systems and methods described herein will be apparent to those skilled in the art and are
`
`encompassed by the invention.
`
`BRIEF DESCRIPTION OF DRAWINGS
`
`5
`
`The accompanying drawings, which are incorporated in and form a part of the
`
`specification, illustrate preferred embodiments of the present invention and, together with the
`
`description, disclose the principles of the invention. In the drawings:
`
`Figure 1 is a block diagram of a network having a collection system according to a
`
`preferred embodiment of the invention;
`
`10
`
`Figure 2 is a flow chart depicting a preferred method of operation for the collection
`
`system of Figure 1;
`
`Figure 3 is a flow chart depicting a preferred method of obtaining geographic
`
`information through an Internet Service Provider (ISP);
`
`Figure 4 is a block diagram of a network having a collection system and
`
`15
`
`determination system according to a preferred embodiment of the invention;
`
`Figure 5 is a flow chart depicting a preferred method of operation for the collection
`
`and determination system;
`
`Figure 6 is a block diagram of a web server using a position targeter connected to the
`
`collection and determination system;
`
`20
`
`Figure 7 is a flow chart depicting a preferred method of operation for the web server
`
`and position targeter of Figure 6;
`
`7
`
`Page 00007
`
`

`

`WO 00/67450
`
`PCT/US00/11803
`
`Figure 8 is a block diagram of a web server using a position targeter having access to
`
`a local geographic database as well as the collection and determination system;
`
`Figure 9 is a flow chart depicting a preferred method of operation for the web server
`
`and position targeter of Figure 8;
`
`5
`
`Figure 10 is a block diagram of a network depicting the gathering of geographical
`
`location information from a user through a proxy server;
`
`Figure 11 is a flow chart depicting a preferred method of operation for gathering
`
`geographic information through the proxy server;
`
`Figure 12 is a block diagram of a traffic manager according to a preferred
`
`10
`
`embodiment of the invention;
`
`Figure 13 is a block diagram of a network including a profile server and a profile
`
`discovery server according to a preferred embodiment of the invention; and
`
`Figures 14(A) and 14(B) are flow charts depicting preferred methods of operation for
`
`the profile server and profile discovery server of Figure 13.
`
`15
`
`DETAILED DESCRIPTION
`
`Reference will now be made in detail to preferred embodiments of the invention, non(cid:173)
`
`limiting examples of which are illustrated in the accompanying drawings.
`
`20
`
`I.
`
`COLLECTING, DETERMINING AND DISTRIBUTING GEOGRAPHIC
`
`LOCATIONS
`
`8
`
`Page 00008
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`According to one aspect, the present invention relates to systems and methods of
`
`collecting, determining, and distributing data that identifies where an Internet user is likely to
`
`be geographically located. Because the method of addressing on the Internet, Internet
`
`Protocol (IP) addresses, allows for any range of addresses to be located anywhere in the
`
`5 world, determining the actual location of any given machine, or host, is not a simple task.
`
`A.
`
`Collecting Geographic Location Data
`
`A system 10 for collecting geographic information is shown in Figure 1. The system
`
`10 uses various Internet route tools to aid in discovering the likely placement of newly
`
`10
`
`discovered Internet hosts, such as new target host 34. In particular the system 10 preferably
`
`uses programs known as host, nslookup, ping, traceroute, and whois in determining a
`
`geographic location for the target host 34. It should be understood that the invention is not
`
`limited to these programs but may use other programs or systems that offer the same or
`
`similar functionality. Thus, the invention may use any systems or methods to determine the
`
`15
`
`geographic location or provide further information that will help ascertain the geographic
`
`location of an IP address.
`
`In particular, nslookup, ping, traceroute, and whois provide the best source of
`
`information. The operation of ping and traceroute is explained in the Internet Engineering
`
`Task Force (IETF) Request For Comments (RFC) numbered 2151 which may be found at
`
`20
`
`http://www.ietf.org/rfc/rfc215l.txt, nslookup (actually DNS lookups) is explained in the
`
`IETF RFC numbered 2535 which may be found at http://www.ietf.org/rfc/rfc2535.txt, and
`
`9
`
`Page 00009
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`whois is explained in the IETF RFC numbered 954 which may be found at
`
`http://www.ietf.org/rfc/rfc0954.txt. A brief explanation of each of host, nslookup, ping,
`
`traceroute, and whois is given below. In explaining the operation of these commands, source
`
`host refers to the machine that the system 10 is run on and target host refers to the machine
`
`5
`
`being searched for by the system 10, such as target host 34. A more detailed explanation of
`
`these commands is available via the RFCs specified or manual pages on a UNIX system.
`
`host queries a target domain's DNS servers and collects information about the domain
`
`name. For example, with the"-/" option the command "host-/ digitalenvoy.net" will show
`
`the system 10 all host names that have the suffix of digitalenvoy.net.
`
`10
`
`nslookup will convert an IP address to a host name or vice versa using the DNS
`
`lookup system.
`
`ping sends a target host a request to see if the host is on-line and operational. ping can
`
`also be used to record the route that was taken to query the status of the target host but this is
`
`often not completely reliable.
`
`15
`
`traceroute is designed to determine the exact route that is taken to reach a target host.
`
`It is possible to use traceroute to determine a partial route to a non-existent or non-online
`
`target host machine. In this case the route will be traced to a certain point after which it will
`
`fail to record further progress towards the target host. The report that is provided to the
`
`system 10 by traceroute gives the IP address of each host encountered from the source host
`
`20
`
`to the target host. traceroute can also provide host names for each host encountered using
`
`DNS if it is configured in this fashion.
`
`10
`
`Page 00010
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`whois queries servers on the Internet and can obtain registration information for a
`
`domain name or block of IP addresses.
`
`A preferred method 100 of operation for the system 10 will now be described with
`
`reference to Figures 1 and 2. At 102, the system 10 receives a new address for which a
`
`5
`
`geographic location is desired. The system 10 accepts new target hosts that are currently not
`
`contained in its database 20 or that need to be re-verified. The system 10 requires only one
`
`of the IP address or the host name, although both can be provided. At 103, the system 10
`
`preferably, although not necessarily, verifies the IP address and host name. The system 10
`
`uses nslookup to obtain the host name or IP address to verify that both pieces of information
`
`10
`
`are correct. Next, at 104, the system 10 determines if the target host 34 is on-line and
`
`operational and preferably accomplishes this function through a ping. If the host 34 is not
`
`on-line, the system 10 can re-queue the IP address for later analysis, depending upon the
`
`preferences in the configuration of the system 10.
`
`At 106, the system 10 determines ownership of the domain name. Preferably, the
`
`15
`
`system 10 uses a who is to determine the organization that actually owns the IP address. The
`
`address of this organization is not necessarily the location of the IP address but this
`
`information may be useful for smaller organizations whose IP blocks are often
`
`geographically in one location. At 107, the system 10 then determines the route taken to
`
`reach the target host 34. Preferably, the system 10 uses a traceroute on the target host 34. At
`
`20
`
`108, the system 10 takes the route to the target host 34 and analyzes and maps it
`
`geographically against a database 20 of stored locations. If any hosts leading to the target
`
`11
`
`Page 00011
`
`

`

`W000/67450
`
`PCT/US00/11803
`
`host, such as intermediate host 32, are not contained in the database 20, the system 10 makes
`
`a determination as to the location of those hosts.
`
`At 109, a determination is then made as to the location of the target host and a
`
`confidence level, from O to 100, is assigned to the determination based on the confidence
`
`5
`
`level of hosts leading to and new hosts found and the target host 34. All new hosts and their
`
`respective geographic locations are then added to the database 20 at 110.
`
`If the host name is of the country top-level domain format (.us, .uk, etc.) then the
`
`system 10 first maps against the country and possibly the state, or province, and city of
`
`origin. The system 10, however, must still map the Internet route for the IP address in case
`
`10
`
`the address does not originate from where the domain shows that it appears to originate. As
`
`discussed in the example above, the .md domain is assigned to the Republic of Moldova but
`
`is quite popular with medical doctors in the United States. Thus, the system 10 cannot rely
`
`completely upon the country top-level domain formats in determining the geographic
`
`location.
`
`15
`
`The method 100 allows the system 10 to determine the country, state, and city that the
`
`target host 34 originates from and allow for an assignment of a confidence level against
`
`entries in the database. The confidence level is assigned in the following manner. In cases
`
`where a dialer has been used to determine the IP address space assigned by an Internet
`
`Service Provider to a dial-up modem pool, which will be described in more detail below, the
`
`20
`
`confidence entered is 100. Other confidences are based upon the neighboring entries. If two
`
`same location entries surround an unknown entry, the unknown entry is given a confidence
`
`12
`
`Page 00012
`
`

`

`W000/67450
`
`PCT /US00/11803
`
`of the average of the known same location entries. For instance, a location determined solely
`
`by whois might receive a 35 confidence level.
`
`As an example, a sample search against the host "digitalenvoy.net" will now be
`
`described. First, the system 10 receives the target host "digitalenvoy.net" at 102 and does a
`
`5 DNS lookup on the name at 103. The command nslookup returns the following to the system
`
`10:
`
`> nslookup digitalenvoy.net
`Name:
`digitalenvoy.net
`10 Address:
`209 .153 .199 .15
`
`The system 10 at 104 then does a ping on the machine, which tells the system 10 if the target
`
`host 34 is on-line and operational. The "-c l" option tells ping to only send one packet. This
`
`option speeds up confirmation considerably. The ping returns the following to the system
`
`15
`
`10:
`
`20
`
`> ping -c 1 digitalenvoy.net
`PING digitalenvoy.net (209.153.199.15): 56 data bytes
`64 bytes from 209.153.199.15: icmp seq=O ttl=241 time=120.4 ms
`
`--- digitalenvoy.net ping statistics ---
`1 packets transmitted, 1 packets received, 0% packet loss
`round-trip min/avg/max= 120.4/120.4/120.4 ms
`
`25
`
`The system 10 next executes a whois at 106 on "digitalenvoy.net". In this example, the whois
`
`informs the system 10 that the registrant is in Georgia.
`
`30
`
`> whois digitalenvoy.net
`Registrant:
`Some One
`(DIGITALENVOY-DOM)
`1234 Address Street
`ATLANTA, GA 33333
`us
`
`13
`
`Page 00013
`
`

`

`WO 00/67450
`
`PCT/US00/11803
`
`Domain Name: DIGITALENVOY.NET
`
`5
`
`10
`
`15
`
`20
`
`some@one.net
`
`Administrative Contact:
`One, Some
`(SOOOOO)
`+1 404 555 5555
`Technical Contact, Zone Contact:
`myDNS Support
`(MS311-0RG)
`support@MYDNS.COM
`(206) 374.2143
`+1
`Billing Contact:
`One, Some
`(SOOOOO)
`+1 404 555 5555
`
`some@one.net
`
`Record last updated on 14-Apr-99.
`Record created on 14-Apr-99.
`Database last updated on 22-Apr-99 11:06:22 EDT.
`
`Domain servers in listed order:
`
`NSl.MYDOMAIN.COM
`NS2.MYDOMAIN.COM
`NS3.MYDOMAIN.COM
`NS4.MYDOMAIN.COM
`
`209.153.199.2
`209.153.199.3
`209.153.199.4
`209.153.199.5
`
`The system 10 at 107 executes a traceroute on the target host 34. The traceroute on
`
`25
`
`"digitalenvoy.net" returns the following to the system 10:
`
`> traceroute digitalenvoy.net
`traceroute to digitalenvoy.net (209.153.199.15), 30 hops max, 40
`byte packets
`4 . 0 2 7 ms
`2 . 2 8 7 ms
`6. 2 6 9 ms
`( 13 0 . 2 0 7 . 4 7 . 1)
`1 13 0 . 2 0 7 . 4 7 . 1
`1.703 ms 1.672 ms
`2 gatewayl-rtr.gatech.edu (130.207.244.1)
`1.928 ms
`3 fl-0.atlanta2-cr99.bbnplanet.net (192.221.26.2)
`3.051 ms 2.910 ms
`4 fl-0.atlanta2-br2.bbnplanet.net (4.0.2.90) 3.000 ms 3.617 ms
`3.632 ms
`4.076 ms s8-1-
`5 s4-0-0.atlantal-br2.bbnplanet.net (4.0.1.149)
`0.atlantal-br2.bbnplanet.net (4.0.2.157)
`4.761 ms
`4.740 ms
`6 h5-l-0.paloalto-br2.bbnplanet.net (4.0.3.142)
`72.385 ms
`7 1 . 6 3 5 ms
`6 9 . 4 8 2 ms
`7 p2-0.paloalto-nbr2.bbnplanet.net (4.0.2.197)
`83.476 ms
`82.987 ms
`8 p4-0.sanjosel-nbrl.bbnplanet.net (4.0.1.2)
`ms 80.416 ms
`9 pl-0-0.sanjosel-br2.bbnplanet.net (4.0.1.82)
`78.406 ms
`79.217 ms
`10 NSanjose-coreO.nap.net (207.112.242.253)
`122.622 ms
`
`79.299 ms 78.139
`
`78.918 ms
`
`80.031 ms 78.506 ms
`
`30
`
`35
`
`40
`
`45
`
`14
`
`3.296 ms
`
`82.580 ms
`
`Page 00014
`
`

`

`W000/67450
`
`PCT /US00/11803
`
`11 NSeattlel-coreO.nap.net (207.112.247.138)
`ms
`114.678 ms
`12 sea-atmO.starcom-accesspoint.net (207.112.243.254)
`327.223 ms 173.847 ms
`13 van-atml0.10.starcom.net (209.153.195.49)
`ms 114.036 ms
`14 hume.worldway.net (209.153.199.15)
`
`115.104 ms
`
`112.868
`
`112.639 ms
`
`118.899 ms 116.603
`
`5
`
`118.098 ms* 114.571 ms
`
`After referring to the geographic locations stored in the database 20, the system 10
`
`10
`
`analyzes these hops in the following way:
`
`130.207.47.1 (130.207.47.1)
`gatewayl-rtr.gatech.edu
`(130.207.244.1)
`fl-0.atlanta2-cr99.bbnplanet.net
`(192.221.26.2)
`fl-0.atlanta2-br2.bbnplanet.net
`( 4. 0. 2. 90)
`s4-0-0.atlantal-br2.bbnplanet.net
`(4.0.1.149)
`h5-1-0.paloalto-br2.bbnplanet.net
`(4.0.3.142)
`p2-0.paloalto-nbr2.bbnplanet.net
`(4.0.2.197)
`p4-0.sanjosel-nbrl.bbnplanet.net
`(4.0.1.2)
`pl-0-0.sanjosel-br2.bbnplanet.net
`(4.0.1.82)
`NSanjose-coreO.nap.net
`(207.112.242.253)
`NSeattlel-coreO.nap.net
`(207.112.247.138)
`sea-atmO.starcom-accesspoint.net
`(207.112.243.254)
`van-atml0.10.starcom.net
`(209.153.195.49)
`hume.worldway.net (209.153.199.15)
`
`Host machine located in Atlanta, GA
`Atlanta, GA - confidence 100
`
`Atlanta, GA - confidence 100
`
`Atlanta, GA - confidence 95
`
`Atlanta, GA - confidence 80
`
`Palo Alto, CA - confidence 85
`
`Palo Alto, CA - confidence 90
`
`San Jose, CA - confidence 85
`
`San Jose, CA - confidence 100
`
`San Jose, CA - confidence 90
`
`Seattle, WA - confidence 95
`
`Seattle, ws - confidence 95
`
`Vancouver, British Columbia Canada
`confidence 100
`Vancouver, British Columbia Canada
`
`-
`
`The system 10 assigns a confidence level of 99 indicating that the entry is contained
`
`in the database 20 and has been checked by a person for confirmation. While confirmations
`
`may be performed by persons, such as an analyst, according to other aspects of the invention
`
`15
`
`the confirmation may be performed by an Artificial Intelligence system or any other suitable
`
`additional system, module, device, program, entities, etc. The system 10 reserves a
`
`confidence level of 100 for geographic information that has been confirmed by an Internet
`
`15
`
`Page 00015
`
`

`

`W000/67450
`
`PCT /US00/11803
`
`Service Providers (ISP). The ISP would provide the system 10 with the actual mapping of IP
`
`addresses against geography. Also, data gathered with the system 10 through dialing ISPs is
`
`given a 100 confidence level because of a definite connection between the geography and the
`
`IP address. Many of these hosts, such as intermediate host 32, will be repeatedly traversed
`
`5 when the system 10 searches for new target hosts, such as target host 34, and the confidence
`
`level of their geographic location should increase up to a maximum 99 unless confirmed by
`
`an ISP or verified by a system analyst. The confidence level can increase in a number of
`
`ways, such as by a set amount with each successive confirmation of the host's 32 geographic
`
`location.
`
`10
`
`The system 10 takes advantage in common naming conventions in leading to
`
`reasonable guesses as to the geographic location of the hosts. For example, any host that
`
`contains "sanjose" in the first part of its host name is probably located in San Jose, California
`
`or connected to a system that is in San Jose, California. These comparison rule sets are
`
`implemented in the system 10 as entries in the database 20. The database 20 may have look-
`
`15
`
`up tables li