How do I track and report an IP address

Chaos Angel · Post by **Chaos Angel** » Sun Dec 01, 2002 11:32 pm

My sister has been receiving harasing e-mails from someone, and she wants it to stop. In the emails, the guy somehow included his IP address. Dumbass.

How, I don't know, but it's there. If someone can tell me how to do any combination of blocking and/or tracking his IP, or reporting his harassment, I would be most grateful. Thanks.

Dannywilson · Post by **Dannywilson** » Mon Dec 02, 2002 1:09 am

Neotrace Pro is a really great program that shows who is, and where the hell in the US/world they are.... it costs about 200 bucks, but not for the resourceful.

kthulhu · Post by **kthulhu** » Mon Dec 02, 2002 1:16 am

Try doing a tracert command. Open a command prompt, type in tracert and the ip address, then hit Enter. I know Win2K has it, and the rest might also. Worth a try.

Note the information about what domains it's going through. From there you should be able to track it down to the person's ISP. Just so you know, his address may be changed if he's using a modem to connect to the internet. Still, since ISPs usually have a pool of addresses that are pretty much the same, you should be able to track it down.

Good luck!

klinky · Post by **klinky** » Mon Dec 02, 2002 1:36 am

Err uhh block the e-mail?

And uhh well he's not a dumbass since every e-mail you send out has your ip address in it too. Unless you proxy or spoof it.

I don't know what you plan to do with his ip address? Bring out the old WinNuke and pray he has Win95a on his computer

Is he e-mailing you from a hotmail or free e-mail account ? Or is it a isp account? If it's his ISP account then you could contact the ISPs abuse reporting center(ha ha

).

If you do a tracert(in all versions of Windows9x and up), just look at the host name his ip resolves to.

Example(hostname in bold):

Tracing route to 12-224-204-196.client.attbi.com [12.224.204.196]
over a maximum of 30 hops:

Obviously I use ATTBI, you can then contact his isp and see what they can do. WHICH = JACK SHIT ;p

I worked for a ISP and they don't really give jack, they're not responsible for how their users actions

They'd rather have him continue paying his monthly fee then them waste money on seeing if he really is "abusing" his service. They're more after people who are wasting their bandwidth(thus costing them money), him shooting off perverted or hate mails doesn't cost them much at all.

~klinky

Dannywilson · Post by **Dannywilson** » Mon Dec 02, 2002 1:41 am

You could always find out the name of your mailservers, and run a program like Avalanche.... hehehe nothing like opening your mailbox to find 3000 messages with 13k attachments, each with a random "Your Momma" joke... hehehe

klinky · Post by **klinky** » Mon Dec 02, 2002 4:06 am

Dannywilson wrote:You could always find out the name of your mailservers, and run a program like Avalanche.... hehehe nothing like opening your mailbox to find 3000 messages with 13k attachments, each with a random "Your Momma" joke... hehehe

Only problem is his ISP would get pissed at him and so would the other guys...

He'd probably get in more trouble then the perv would or whatever. I think rightfully so. Block the fucker and call it a day.

~klinky

Chaos Angel · Post by **Chaos Angel** » Tue Dec 03, 2002 2:59 am

Thanks for the info, everyone. I had no idea my IP went out in every e-mail; I send... I've never seen it. This guy, it was there, clear as day. "IP: 111.22.3.444" (I made that up, I don't have the number on hand at the moment). I've enver seen that in any other e-mail.

Probably true that the ISP won't give a damn. But, I can try. At least I can maybe block him out...? ::crosses fingers::

Thanks again.

klinky · Post by **klinky** » Tue Dec 03, 2002 3:17 am

You can't really block "HIM" out because it's not him who's sending the e-mail to your e-mail server.

It goes like so:

HIM --- >His E-mail server --- >Internet --- >Your E-mail server --- >You

The only real way to block him is to block his e-mail address in whatever program or service you're using to get e-mail with. Or you can block any messages from his ISP, but that would be a bad move.

~klinky

danielwang · Post by **danielwang** » Tue Dec 03, 2002 5:02 am

Actually, just on a technical note, this is what u should do:

Most people have a dynamic IP, which means that their IP changes every so often. ISPs keep detailed logs so they can find whoever had that IP at a certain time, but those records take up a lot of space and are usually phased out... point is, you need to forward exact email to email address..

1. Try abuse@source.com

First step is Email source, e.g. johndoe@yahoo.com
If that is obviously faked, e.g. he leaves "nobody@isp.com"
or in any case, look carefully in the headers...

2. Try abuse@router.com

Usually something like xyz012-cl-soap8v.s.ty.us.smtp.email.com
There is a hoplist, and if he can manage his mail server to fake hop information, most servers certainly wont! Trace it as far back as you can and it should how...

3. If all else fails, try his IP address / ISP! Or, do it all anyways (and get him in real trouble too he deserved it)
tracert and neotrace only show infos on current sessions, whoever the heck suggested that. What you want is something like:

nslookup 123.45.67.89

ping -a 123.45.67.89

netsh does it too

Daniel Wang