Using iftop and ips IP tools

[SJ77]

Hi, 

I’m using iftop and with this tool it’s pretty easy to see the IP address of the top bandwidth hog. The thing that is surprising to me is that if I take the IP address and go into the ACP, and entered into the IP tools I’m not finding anything associated to this IP address. Not a connection not a user, nothing.  
which is surprising to me because I’m on a dedicated server and this site is really the only busy site on the server. 
I guess my question is if this IP address is not on the InVision power site what on earth is it doing and how is it using so much bandwidth on my server? 
is there anyway to figure out if this is a genuine user doing something they’re supposed to do or possibly an intruder stealing my resources?

any next steps to research this or ideas?

 

[Adlago]

This tool collects and displays in addition to the IP of your users and server IPs that have connected an end client to your site.
This is probably why you do not receive information about each IP with the IPS IP Tool.
You may need to try some other IP tool's controls, for example

http://www.iptools.com/

https://www.ultratools.com/tools/ipWhoisLookupResult

https://hackertarget.com/ip-tools/

etc.

[bfarber]

You can grep through your web server's access logs for the IP address to see exactly what files/URLs they are requesting.