How to find the IP-address

that covers all the IP's assigned to that hostname

All right, I'll do that. But still there could be normal guests with that host name or is that impossible now?

All the ip's covered in that list reso,ve to the hostname in question.

Oké, I banned those IP's. Thanx for helping. When I'll get spam again, now I know what to do!

How to find out what is the IP of the next host: duesselderf.vhm-ibb.de

Use dnstools.com same as before.

I did, but he says:

Domain Whois Results:

domain: vhm-ibb.de
status: connect

IP Whois Results:

Connecting to whois.arin.net...

No match found for duesselderf.vhm-ibb.de..

# ARIN WHOIS database, last updated 2005-12-09 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Whats the full hostname from the guestbook?

Host: duesselderf.vhm-ibb.de

Have you tried just visiting vhm-ibb.de ?

I even tried it.

Now if you just use the ibb.de this is what you get. It looks to be a website for a bank.

Domain Whois Results:

domain:      ibb.de
status:      connect

IP Whois Results:

Connecting to whois.arin.net...

Deferred to specific whois server: whois.ripe.net...

% This is the RIPE Whois query server #1.
    % The objects are in RPSL format.
    %
    % Note: the default output of the RIPE Whois server
    % is changed. Your tools may need to be adjusted. See
    % http://www.ripe.net/db/news/abuse-proposal-20050331.html
    % for more details.
    %
    % Rights restricted by copyright.
    % See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
    %       To receive output for a database update, use the "-B" flag.

% Information related to '213.61.227.160 - 213.61.227.191'

inetnum:      213.61.227.160 - 213.61.227.191
    netname:      DE-COLT-IBB-1
    descr:        INVESTITIONSBANK BERLIN
    descr:        BUNDESALLEE 210
    descr:        D-10719 BERLIN
    descr:        abuse? mailto:waldemar.frankowski@investitionsbank.de
    country:      DE
    admin-c:      FW412-RIPE
    tech-c:       FW412-RIPE
    status:       ASSIGNED PA
    mnt-by:       DE-COLT-MNT
    source:       RIPE # Filtered

person:       Frankowski Waldemar
    address:      Spichernstr. 2
    address:      D-10777 Berlin
    address:      Germany
    phone:        +49 3021 252920
    fax-no:       +49 3021 252902
    e-mail:       webmaster@investitionsbank.de
    nic-hdl:      FW412-RIPE
    remarks:      administrator contact
    mnt-by:       BO-DOMREG
    source:       RIPE # Filtered

% Information related to '213.61.0.0/16AS9126'

route:        213.61.0.0/16
    descr:        DE-COLT-INTERNET-213-61
    origin:       AS9126
    mnt-by:       DE-COLT-MNT
    source:       RIPE # Filtered

% Information related to '213.61.0.0/16AS8220'

route:        213.61.0.0/16
    descr:        COLT-DE
    origin:       AS8220
    mnt-by:       DE-COLT-MNT
    source:       RIPE # Filtered

Checking Port 80...

Port 80 is open and accepting connections.

Ping Results:

Ping server http://ibb.de (<3 ms)
    Site link http://ibb.de OK!

I banned all the IP's between 213.61.227.160 and 213.61.227.191, but still spam is in my guestbook!

Blocking the IP's will only stop future spam entries from them IP's.

Yes off course. After I banned those IP's, still spam was entering in my guestbook. Isn't that strange?

Just means you got IP wrong. Search the forum for my mod to make AG store the ip and not the hostname.