I need advice on how to trace an e-mailed message.

Hello,
I am in need of a way to trace an e-mailed message back to its originating computer. I have recently opened an ISP in my small mid-western town. ( I brought fiber into this area and of course have exclusive rights to who can connect to it. ) Naturally, I have the fastest connection and the most bandwidth to offer my customers than the other two ISPs that are laughingly my competition. (They are still using analog phone lines and antique modem banks on PC's of all things for their servers...my equipment is ALL state of the art Cisco, Sun, Ascend, etc...) I opened this ISP to provide a quality service to my community, my competitors are fleecing their customers and slandering me in the process...and I have about had it!!!
I have been targeted by them and have piles of logs to show their feeble attempts at comprimising my security. I am being bombarded by DOS attacks, e-mail trojans and the like. I need to obtain the MAC addresses of their equipment so the authorities can seize their equipment and expose them for what they really are. This has to be repeatable as well so I can show the authorities that I am not blowing smoke up their a--'s. I know all this to be true as none of my customers are getting these mailings only my partner and myself are being targeted, my anonymous e-mail addies have not been getting these attacks either, and I have them subscribed to the same forums and sites that my public addies are on, and they reside on the same servers.
These atrocities need to be acted upon now and thouroghly, because if I let this slide I am only going to encourage them to keep it up. They have pis--d up the wrong tree this time, I am going to show them one way or the other that I am here to stay and they will have to like it! I opened this expecting competition, and welcome it as that only serves to improve the services that they offer by forcing them to improve and update their own equipment, I never dreamed they would declare war on me!!! These folks are being childish and unscrupulous opponents and deserve to pay dearly for their actions. For more info on their activities visit my web site at RIP Internet

Well their MACs wont show up in an e-mail but you can find their IP in one as long as they aren't using an anonymous e-mail service. But they most likely are. Maybe you can hire a white hat to do some network security work for your ISP.

Actually, grab an e-mail they sent you and post the header here, us AOers will try to find what we can, if enough work on it maybe we'll get the job done. So grab a few e-mails and post the headers and any other pertinent information you have. You may wish to block your own e-mail address from the header though.

Remember, email headers can be forged, so they don't prove a thing.

I think it's best for your business to just ignore the childish actions of your competitors. That'll gain you two things: first, you can spent your time working on, for and with your customers, thus raising the level of service you provide (and compete even better). Second, people don't like mud-fights. Going public with this will result in a drop of subscribers, I think. People are interested in quality and service, not in who got something first.

well...a couple of things...first...take 2 steps back, a deep breath ...anger in these situtations...as understandable as it is...can lead you to do some silly things...the worst being trying to "get back at em" (ie: "one way or another...")

sounds like you are doing the right things...log log log...you shouldn't need much more...but as much detail as possible. If you can convince the police that the attacks are costing more than $5000 i believe they are required to investigate...(correct me if that not right..)

if you can get a hold of any kind of printed documentation to prove that they are slandering you or your business...well..get that and get a lawyer.

as for being bombarded by trojans...ha...who isn't...not much you can do there except keep av up to date...

but i guess my question would be...if their attempts are "feeble" well...consider it practice...and if your network and business practices are superior...you'll "win" anyway...it's just a matter of time...

That would get annoying, Just be happy in the knowledge that people will probally flood to your isp and the others will go out of buiness ;-)

Correct me if i'm wrong but mailing trojans is rather childish so a check on the headers could give some information..

Good Luck..

ThaVolt

Definately if you make this public, it will cause a drop in subscribers, as you will be seen as a dodgy isp. I know you said none of your current subscribers get emails etc. but they might soon, it'll only be a matter of time. That could put people off subscribing as they'll be afraid it might happen to them, remember, they might not have firewall/av software installed.

PranKster

Quote:

---

Originally posted here by Guus
Remember, email headers can be forged, so they don't prove a thing.

I think it's best for your business to just ignore the childish actions of your competitors. That'll gain you two things: first, you can spent your time working on, for and with your customers, thus raising the level of service you provide (and compete even better). Second, people don't like mud-fights. Going public with this will result in a drop of subscribers, I think. People are interested in quality and service, not in who got something first.

---

he said they can be forged, so information from the headers is irrelevant, am I right?

One word:

procmail

:D

Seriously, Zigar has it right. If you approach this with a revenge attitude, you'll likely get yourself into more trouble than your competitors. And Prankster is right from a public relations standpoint. Unnecessary publicity about this could have repercussions. These individuals don't sound too bright, so a glance at their mail headers may bear some fruit. If the IP's they are using are consistant, and don't resolve to a valid domain you could just configure your mail server or router to ignore those specific addresses or even that range. Just make sure that you're not getting valid traffic from that range beforehand! :bigsmile:

Other than that, since these guys are only targeting you (thankfully not your customers), just start sending those messages to the bit bucket. If you're familiar with procmail, you can even setup a procmail recipie that will generate a fake email auto-reply for un-recognized addresses that appears to be coming from your mail server that says your address has been removed from the system. Good for spammers, too!

Although, if this is your business address, that might not be too smart. Hmm... I guess it's just best to trash them.

Spams can be a pain in the backside. To circumvent this issue, I use the following two programs 'eMailTracking Pro' and 'VisualRoute'. These are neat little toys to drill down to the originating IPs. You already have the logs. So, give it a shot and you might have more specific data for the proper authorities.
Hope this helps!
Abbas

Quote:

---

If you can convince the police that the attacks are costing more than $5000 i believe they are required to investigate...(correct me if that not right..)

---

Zigar> It does depends on the country. Here in "our" country, the police is obligated to investigate anything that counts to losses. The only difference is that over 5000$ becomes a serious offense punishable by a term not exceeding 14 years. :)

Going public, like many have said, could cause bad publicity for both you and them. People will want proof, and some people, as ignorant as they can be, will side with the competitors (ie: "your proof is tampered", "evidence is created"...)

Going to the authorities is better. Once your side has been established by the authorities, they will provide the info that the public can know. Make sure to log as best as you can and check out JP's How to be a Profiler section on the main page...

I did not expect such a quick response on this subject...Thank you all for your insights. I definatly agree that mud slinging is bad practice, and it is not my intention to sling any at them. I do, however, want to collect viable data and evidence that they are using un-fair practices to deliver to the authorities. As for revenge I don't wish to put that across to anyone, I am not violent in nature, and don't want to be. I know that my business will prevail and they are destined for a long rough road ahead as they are slinging the mud publicly, for the moment they are winning as our subscriber recruiting has dwindled to about 2 or 3 a month. We oficially opened our doors on the 8th of March and through May we averaged 1 a day. As for losses...do the math I believe we have broken the $5000 mark if that is what it takes to get the authorities involved. My overhead is over 6000 a month not counting paying ourselves, or the initial investment, and we are not even pulling in a tenth of that yet, I think you will agree...if you visited my site...http://www.ripinternet.com ...that we are covering all of the bases including handing out fliers at local events, and visiting at local places such as the barber shop, convienience stores and such. We are really working hard to generate business, but the general rumors and public gossip has us labled as thieves and liars, even playing on our name RIP Internet (Richardson Internet Providers) as we are stealing from the public with lies about our abilities and expertise. To put it in a nutshell, they are sorry that they did not think about running in fiber cable and we have exclusive rights to that cable and they would have to come to us to connect to that cable....

We will ultimately prevail...if we don't go broke first...

I can give you one advise that'll surely pay off: lose the blinking text on the mainpage

http://www.antionline.com/showthread...hreadid=229494

Quote:

---

Originally posted here by abbasali
Spams can be a pain in the backside. To circumvent this issue, I use the following two programs 'eMailTracking Pro' and 'VisualRoute'. These are neat little toys to drill down to the originating IPs. You already have the logs. So, give it a shot and you might have more specific data for the proper authorities.
Hope this helps!
Abbas

---

VisualRoute 6.0 will do the trick for tracing. Go to www.download.com and get the trial version to check it out. After you establish their identities, contact the authorities. If, upon further investigation, it turns out that THEY have been hacked in a manner that makes them appear to be the source of your woes, you've picked up a mighty fine marketing tool to sway their customers in your direction. After all, who wants an insecure, or unethical for that matter, ISP? Best of luck to you!

You may wish sending a semi-formal letter to your competitors telling them that 'rogue employees' at their company may be attempting to attack your company. (As long as you are sure that it isn't individual public subscribers to their ISP who are doing it.) The management of the other companies may crack down on rogue employees, or may think twice, depending on the actual situation.

More advice on your wepage...

1. Fix your DNS server so that http://ripinternet.com works as well as http://www.ripinternet.com . You don't want a user to make a mistake and thing that your site is down or a fly-by-night outfit.
   
2. Are you planning a front page redesign? The color scheme is just a little bit strange with dark grey and dark green text at one point... Have you considered changing the site to something a little more...well... personalized? Do you have a logo for your ISP? Have you decided on a consistent look/feel/color scheme?
   
3. One thing you might wish to do is change the pages so that they do not use the default link scheme of Internet Explorer, which is Blue links, Purple visited links. It looks strange.
   
4. It would be useful to change (with javascript) the form on 'sign-up' so that the enter key does nothing, thereby eleminating partial-submissions.
   
5. http://edison.ripinternet.com/ seems to be down.
   
6. I notice the explanation for Fiber vs Copper
   Quote:

   ---

   Imagine if you will a piece of copper wire (the size of a single strand of your phone cord wire). Imagine if it is five feet long. If you use a device called an impedance or Ohm meter you can verify that there is a measurable amount of resistance in the wire. This resistance increases the longer the wire gets. So basically a ten foot wire will have twice the impedance or resistance as a five foot wire. This impedance or resistance is what slows down the transfer of data through the wire.

   ---

   You may wish to 'dumb it down' by using the analogy of a pipe which has a smooth or rough inner surface. I know some people who will think that an Ohm is a measure of spiritual enlightenment. "Ohmmmmmmm....."
   
   Also, in the next paragraph... Fiber doesn't HAVE electrical resistance because it transmits light impulses, instead of electrical impulses. It's a bit misleading.
   Quote:

   ---

   With a Fiber Optic cable that is Five feet long there is so little resistance that it is impossible to measure it.

   ---

Hi Guus,
Are you refering to the animated .gif {that I despise and have voiced this to the page designer} it loads too slow and impresses me not. Unfortunatly, I do not hold controlling interest in this venture, my partner (with all the degrees in graphics design ) has the final say in asthetics. I just do the technical stuff. Although the site does have a feed back form, if enough people fill out this form then maybe he will make some changes...

P.S.
He does not know that I am dissing his creative tenure, and does not visit this site, he is a business man great with numbers and loaded with a gift of gab that can sooth the savage beast, but, he is also very sensitive to criticism from within his realm...:) Please don't reference this as I will have to deal with his also very accurate and sharp toungue. hehehe

I ment the static text, just, plain, text, that keeps blinking on the page. It's done with the 'blink' CSS keyword. For example, on top of the main page, the sentence "RIP Internet - Dallas County's ONLY Fiber Optic ISP Network" keeps blinking.

Look at Terr's post. He has some other good design-advise.

"OIC", says the blind man as he pis--d into the wind, "It all comes back to me now"

lol....I suppose that you are not using a browser that takes advantage of FrontPage extensions...that text is supposed to be a scrolling marquee.

:urinate:

Just a suggestion... download Opera from http://www.opera.com . You can use it in free mode, and it gives you an idea of what some people may use to view your website, and you can check for compatibility accordingly. The Opera folks make a big deal about how their browser (which I like) is fully standards-compliant. If a it shows up right in Opera it is probably all-browser-friendly, as opposed to "You don't have Internet Explorer? Tough."