Barb Dorsett asked:

>Can anyone help me with the method/tools I need to start deciphering
>Hotmail's IP fields?

Using various tools you can convert the IP number to a domain name. I use
whois.arin.net to do my lookups. If you don't have whois software you can
go to:

  http://www.arin.net/whois/arinwhois.html

>  206.43.209.105 is the relevant, *innocent* address in
>this case.

This number is registered to:

Ganymede Systems and Technology (NET-GSTEC1-DN-NET)
2205 Northwood Drive
Salisbury, MD 21801

Netname: GSTEC1-DN-NET
Netnumber: 206.43.209.0

Coordinator:
   Walsh, Sean M  (SMW2-ARIN)  [log in to unmask]
   703 813 7537 (p)  703 689 0372 (h) (FAX) 703 642 0516

And is part of the netblock registered to:

digitalNation Internet Services (NETBLK-DN-CBLK32)
5515 Cherokee Ave, Suite 100
Alexandria, VA 22312

Netname: DN-CBLK32
Netblock: 206.43.192.0 - 206.43.223.0

Which in turn is part of an Agis netblock covering 206.42.0.0 - 206.43.255.0

Don.