Email Trace

[nebulus200]

I first when to ARIN's web page and did a standard whois request off of there. I always start at ARIN because it will at least tell you what Registrar that space is assigned to (whereas the others in my experience don't). It then said the space was registered with RIPE (Reseaux IP Europeens) and issued a standard query based on the IP.

There are other things you can do to modify your query, but the reason I supplied what I did was that it provides who to contact in the ISP from which the email purports to have originated from. That is who your friend would have to contact to track it further (or police or your ISP, depending on how you want to do it...)

/nebulus

[Lebb]

What about a mailer?

[hjack]

Just figured I'd put this link up. Its about reading e-mail headers. Explains pretty well.

www.stopspam.org/email/headers/headers.html

[Lebb]

What I actually ment was an independent mailer program on the web, sorry I have no examples as they are illegal.

[mindfuck]

Originally posted here by dontpanic
Hello,

Question: I have a friend that received an email from an anonymous user and would like to know if it can be traced.

Is this possible and what does it involve?

Thanks,
P.

Look at the raw email, if you're using outlook express, right click on the email and click properties, then over to the 2nd tab.. If it was sent by a "anon email" application, you can find the ip of the person. IE

Recieved from: dumbho.st [1.2.3.4]

[lovebugz]

what is ARIN?

[thehorse13]

ARIN is a database of domain names and their respective owners. More specifically, whois.arin.net.

Here is what the ARIN database has to say about AO:

[root@hax0r]#whois -h whois.arin.net www.antionline.com

Registrant:
Jupitermedia Corporation (ANTIONLINE2-DOM)
23 Old Kings Highway S.
Darien, CT 06820
US

Domain Name: ANTIONLINE.COM

Administrative Contact, Technical Contact:
Jupitermedia Corporation (ZFBKBPQRAO) hostmaster@internet.com
23 Old Kings Highway S.
Darien, CT 06820
US
203-662-2800

Record expires on 04-Sep-2005.
Record created on 05-Sep-1997.
Database last updated on 16-Jun-2004 06:28:46 EDT.

Domain servers in listed order:

NS1.INTERNET.COM 63.236.72.133
NS3.INTERNET.COM 63.236.72.135

PS, if you look closely at this thread, it is over a year old. Blinking dates indicate that the thread is old and it is generally understood that no further posts will be made. Since you are new, I answered your question even though, technically, this thread is dead.


--TH13

[Relyt]

lovebugz

When the dates are flashing on a thread that indicates that the thread is old. Try not to reopen threads that are this old 5-11-2003.

google is packed with a wealth of information and to access this bank of knowledge, type in www.google.com and the enter your question. Here's the very first link that turned up after entering Arin in the search engine.

http://www.arin.net/

It means: American Registry for Internet Numbers

cheers

edit: guess I'll just have to type faster theHorse

[lovebugz]

thankz u guys all

[Galdron]

Lovebugs, Welcome to AO!


As an afterthought, a great, and often reccomended site for use of the Arin, who is, ect...

Try- www.samespade.org

It is a nice test drive, and a great Web Tool.

Good luck, have a great weekend!





Edit Kudos to Horse, and Rey for not flaming a thread ressurection.