i have a logresolve script that combines MySQL with DNS to convert logged IP's into FQDN's and logged product codes into their full name.

the problem i have is those "non existent" domains. is there any way i can work out at least which higher level domain these IP's come from?

my guess is the ISP allocates the IP at connect but hasn't registered the IP.

any help would be appreciated.