IP tracing

Don't know where to put this, but is it possible for people to be able to find exact locations for an IP address. For example, you get someones IP address. Is it possible to be able to find their exact location, like street address?

There are ways, not easy though. If you want to narrow it down to a city, you can always just use NeoTrace, probably the easiest way to trace an IP to a physical location.

although there is nothing in the design spec for the internet protocol to give exact geographical locations of nodes (because it is a logical address) i believe it is possible, with the help of other systems and applications to get an idea of the geographical location.
Geoboy http://www.rocketdownload.com/Details/Inte/2245.htm and NeoTrace are commercial applications that will give you the general area, but theres nothing like a good map to get street addresses.

but i reiterate: it is not possible to be exactly sure from an ip address because this was not in mind when it was designed and developed - because it wasn't an issue.

From the research I have done this is next to impossible without some in depth research on your part.

Step one would be to get that IP address and what company it belongs to.

Step two would be to contact the company and find out what ISP rents that IP range (or if the company itself uses that IP range).

Step three would be to contact the ISP renting the IP range and find out some info about them (most companies are free with telling you where they are located).

Contact is not necessarily necessary after step two. You could research on the internet to find out where the company is located.

D'elTarra

But can't the government trace an IP to find people like malicious hackers.

They go through the same basic steps that DelTarra said.

1. Get the ip, and determine what ISP its with.

2. Find the contact details of the ISP

3. Since they are the govenment, the isp will most likely give out the information they have on the client e.g. address + phone number.

You might be able to bluff (ph34r s0c14l 3ng1n33r) your way through the isp by saying your a company, got hacked or scanned etc and wanted to call them. That is if the person you are talking is either gulliable or stuipid.

Then again if you find that you were hacked by a malicious hacker that acctually knew his stuff, chances are the ip that you will trace wont be his, just a computer that he has hax0red and trojaned/proxied/rootkitted, and was bouncing his ip off to make it look like he came from there. You would have to go down a long trail of logs to find the original ip.

Hello. I'm new here so please don't laugh too hard when I sound dumb. ( A little maybe...just not to loud as to wake the baby.) Is it possible to find a location ( city, street, whatever) by using an email address? Can an Ip be found thru email?

Ya try something like visualroute http://visualroute.visualware.com/

with the e-mail address as far as i know yes they can find out location because there is the email all they have to do is get the info about the recipent from the isp

dacObraman, Thank you. How do I get the info from the ISP? I know it's pacbell.net but when I ran a trace all I got was that it was a valid email address.

Look at the email headers. Generally, this is the properties of the email (with Eudora there is a button that is labelled BLAH BLAH BLAH that shows full headers -- in Outlook you need the properties of the email itself). In there you will see the source IP address of the person that sent you the email (most times).

We have an IP locator here.
You can quickly play with it to understand how inaccurate this sort of technics can be (it locates me in Amsterdam!!!!).

KC

I think the IP locator is fubar'd. Apparently I'm in Australia. :D

I went there. I guess my gear works cause it says my Ip cannot be located. Thanks for the help .... everyone.

well fist thing to do is check
www.ripe.net (europe)
www.arin.net (us)
www.apnic.net (asia)
for the ip address, when you get a hit i will display the owner of the ip address 99% of the time this will be an isp, the last 1% it will be a major coorp running their own network.

in the registry u can see who's in charge of the IP net - name of the isp/coorp, email, address, phone number. etc. If you think you have a good case call em.. if ur case is weak forget about contacting them. Belive me it takes a lot to make them hand over the info on one of their customers.

another thing you can do is to do a traceroute, often isp's use locations as domain names for their ip addresses ex. so-1-1-0.2488M.albnxu1.ip.ispxxx.dk (xx.xx.xx.xxx) this means the router with the given ip is located in aalborg Denmark. now your one step closer. it is not for certain that this works but most of the time it does.

next step if you really really want to know who has the ip address is to contact the isp, and try and lure information out of em... This can be done but not without the chance of being exposed... I will not describe in details how to do it, that is up to your imagination.

whois gives you the ISP's info (normaly)

I provide a small (beta) whois service.. but most unix/linux users can just as easiy whois themselves..

whois ip.addy

or

whois domain.com

Most ISP's provide an ABUSE email addy..

Or.. Sam Spade is a good one.

Just on a follow up to what the_JinX and MsM said.... for those of you that like to stick to the command line in windows (I know that's what I prefer).... you can get a command line whois program for Win32... It is available for download here:
http://www.cmdtools.com/files/inet32ut.zip

EDIT:

Here's another as well
http://www.cmdtools.com/files/dwhois.zip

Quote:

---

Originally posted here by mupp3t

3. Since they are the govenment, the isp will most likely give out the information they have on the client e.g. address + phone number.

---

Actually, the vast majority of ISPs will NOT provide your information freely to the government. They usually do respect your right to privacy and their TOS, Privacy Policy, etc.
However, Once the governmental agency shows up with a Search Warrant or send them a Subpoena (Depending on what info is needed) the ISP is forced to comply with the request.
Bear in mind that this is how it works in the U.S. :thumbsup:

Quote:

---

Look at the email headers.

---

how do i check the email header if i have an account on yahoo...msn...mail.com etc ?

I don't know if you can. Web-based emails tend not to show full header information. Check your options or personal preferences (whatever the site calls it) and see if there is an option to see full headers.

Ideally, collecting your email with a program like Eudora or some other email program would allow you to see the header info.

To grab info about an IPaddy there still some olmd fashion:
Traceroute is good to give you the last router IP address and name (if the router accept to reply ICMP unreachable & main ISP does).
From the name u can deduce the ISP and sometimes the city.

u may use not only trace route but ...things like www.visualroute.visualware.com or other programms to trace an ip... like neotrace....but i dont dont know what is happening if someone uses a proxy...like in the case of IRC .. and the person has loggined....u see another ip...and still how do i trace am email? on linux..or without eudora...

I found an interesting site that has some usefull and easy to use tools for operations like IP tracing.

http://www.phaster.com/find_info_net_traffic.html

E-mails are only traceable to a person who is not trying to hide. You can trace e-mails from their headers but often times these are incomplete or have spoofed information. Also there are still mailers that allow annoymous mail/relaying which means once you get to that mailer you've really got no where else to go. (Unless the owner of the mailer feels like letting you paw through his logs which is not likely to say the least.) REMEMBER: The only thing a clever attacker needs to become anonymous is 1 compromised machine.

-Maestr0