Weird Email

i got an email from my friend saying stuff about him that he wouldn't say or that were true.( it was sent to several different people). and he use dial up. and when i looked at the originating ip it wasn't a dial up ip so i know it wasn't sent from his computer.(but it was sent from his email account) i took the originating ip and i use the antionline Ip locator to see if it was local person who was doing it and it was. same city. so i wanted to know more about this email origination. any help would be great.

Well how can you be sure that the IP address wasn't dial up? have you tried tracing your friends IP address from an email you know that came from him? That way you can make sure it came from two different places. Plus What kind of email account is it, a free type or an actual email account from an ISP provider like Adelphia or Earthlink or such?

Just a thought...
~AciD

Hmmmmm if he was using hotmail, yahoo, etc or any free e-mail service someone could've gaines access to his password.

and u said he has a dial up modem, a hacker could have got access to his dial up number


just a few thoughts

BD]Hobbit

if an ip is like 24.000.00.000 it's none dial up. is that right? it was a free email account it was hotmail. and the originating ip was local. and his IP from other emails were 192.000.0.00 so it wasn't is computer.

Do hotmail accounts send the originating ip or just the ip of hotmail servers? Havent had too much experience with hotmail nor would want to. Ip address has nothing to do with determining dialup the first one is a class A address and the 2nd is a class C if my memory is serving me. Some comfirmation on that little bit of info would be nice. Also the ip that you found that you said was local. are you sure it was local or the company that registered it was local? How much distance do they serve.

PeacE
-BoB

i dont really want to reveal the information or the ip but for obvious reasons. all i need to know is how to find out more about the ip or a more exact location. But the email was about a person who my friend knows and i know and most all my friends. but thats the most of what i want to reveal. i hope you understand.

How many times has this subject been brought up in the last week. there is no way to "pinpoint" a location. As has been stated it will merely reveal the company that registered it. If you are really worried about it you could do a whois on the ip address and contact them about it. Also the ip address wont reveal anything personal about you or your friends just wanted to make that clear.

PeacE
-BoB

Quote:

---

Do hotmail accounts send the originating ip or just the ip of hotmail servers?

---

X-Originating-IP: 366.366.366.366
Yes they do, hotmail is not anonymous.

Quote:

---

X-Originating-IP: 366.366.366.366
Yes they do, hotmail is not anonymous.

---

I'd say that is accurate.

I would just like to add the obvious... if the sender was using a proxy or proxy chain... it is less likely that you will find the senders true address. You would instead see the proxies address...

It is not anonymous by itself.

Check the full headers in the e-mail. Read also:

http://astalavista.com/library/basic...mailHeader.zip

on how to interpret headers.

Plus the fact also sits with, how the person gained access. Your friend might want to sit down and think of the computers they have used to log into their hotmail account. If someone setup a keylogger on that computer, it would obtain the user ID and password. Or maybe your friend accidentally set his account to auto login anytime someone went to hotmail.com. Just so you can back track and maybe go that route with trying to figure out who might have gotten in and sent the email.

As for tracing the IP, there is only so much a typical person can do. You can trace someone's IP back to the server itself, but you can't get much more information then that. I've been down this road before for clients of mine, so I know how it is. The companies have to hold all personal information on an account. The only thing they can tell you for sure is if the IP does belong to them. To get anything else you would need a warrant, and the police/FBI/whoever would have to talk to the people at the ISP to get the proper information. Then only will they be able to go and question, they probably won't even tell you who it is. Unless they have reason to believe that person is the one responsible for sending the email. But by then that person would be charged anyway and it would become a court matter.

That's about the best I can do for you, sorry I can't be of much more help. But there is security and privacy for a reason, to protect you and to protect everyone.

Just a thought...
~AciD

WOW! I always, kind of, assumed hotmail was "somewhat" anonymous. I just did a test and there it is in plain text. My machine IP address. Well my gateway's public anyway.

None of them are anonymous. How else would you be able to track the email message if the originating IP wasn't attached? Having the IP there is for safety/security reasons. True you can use a proxy server to kind of hide your IP, but it could still get tracked if it has to. Not for the fact everyone wants to watch where their email is coming, but if someone was trying to hide and send out death threats, I think they would need to be tracked right? I could be wrong though.

Just a thought...
~AciD

Using the tools at Sam spade you can track it to the originating company, and at this pint you are either SOL(if its AOL or earthlink, or someone else big). Or you have hope if its a small ISP/library/school. You can show them the evidence of what happened and hope they help you out.

arent 192.xxx.xxx.xxx IP's strictly networked based IP's? I thought IP's from dial-ups usually started with 64 or 68 or even 172's?

192.xxx.xxx.xxx are internal IPs, yes. They work only inside of a Local Area Network (LAN). High speed IPS usually start with the same number also. But it usually depends on where you are at, and what country. I know cable Internet around here has 64 and 24, and there's another one. DSL around here has 141, and a bunch of others.

Just a thought...
~AciD

AcidDriveHB > Only the following IP ranges are not to be routed to the internet.
192.168.0.0 - 192.168.255.255
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
It is not the whole 192.x octet that is reserved for private IP's.

thanks for clearing that up!

No problem, I just don't want someone else reading it, then thinking it was correct, and posting it here again or somewhere else, then someone else sees that, and it keeps going, and going. . .
Better to keep the information posted here at least accurate. :)

LOL yeah I know what you mean. I would have looked it up online if I had the time at the moment. Actually isn't there a thread somewhere on AO that talks about all the IP ranges? If I remember reading somewhere...

~AciD

Is there anyway to tell if someone other than myself has been accessing my msn account?

Now do you mean on your computer at home, or do you mean just in general in the world?

IF it's your computer, yes there are ways of logging what people do on your computer. As for if people are viewing your email from other computers, I think that is something you would have to ask M$. Then only I think they would care if there is something illegal going on. I've just sat checking out my account for options or something and found nothing that would really let you know who was the last person, or better yet what the IP address was. But like I said that's what I found after taking 20 minuts to look.

~AciD

I know that hackermail.com has this option :),but it does not have the same secure login process that hotmail has cuz it doesent support ssl(Secure socket layer)encryuption.

Quote:

---

Is there anyway to tell if someone other than myself has been accessing my msn account?

---

Awhile ago someone kept getting into my hotmail account and changing the password. so i contacted i think it was [email protected] or somehting like that. but after i sent that email i tryed to get into my hotmail account once more just to for fun. and it worked. So later on about 30Min. i got the email back from [email protected] and they said that i have access my account since i sent the email. so everything must be alright. and they said if i needed them again just send an email. so they can tell you is your account was access and when it was access so they must be able to tell you the ip of the last time it was accessed. Send them an email and see what you can get out of them.