Tracing that IP to the ISP

First before I go on, I want to say this tutorial is for the noob. Please dont flame me if you already know this because you are super l33t h4x0r. I also want to say that I take no responsibility what so ever for any actions you take using this knowledge. Don't make false reports just to kick somone off thier ISP or at least give them a bad reputation with their ISP. Or whatever else you can think of doing with this info.

Since the time I first came here, which was only about a week ago lol, I have already answered about 3 questions on this topic. For this reason I have decided to write a little tutorial on IP tacing in hopes that it will answer any more future question on this subject. At least reduce the amount ;).

So now that we got that out of the way I ask you, have any of you noob's been getting spammed latley? Has anyone been emailing you threats and you want this to stop? Well, then this tutorial is just for you!

What you do is open up the unwanted email and look for an option that says something like "View Full Headers". It will be a little different depending on your email client (Outlook, yahoo, hotmail, etc). Once you have found the option and clicked it you should look at the email again. Notice anything different? Now there is alot more info above the email. This is information of the sender that sent you the unwanted email. Now look for the "From:" or the "Received from:" line. There should be an IP address. Now take that IP address and do a WHO IS search. When the results come there should be a name of the hosting company. Under the name there should be an abuse email address (ie: [email protected]). If there isn't an abuse email address then go to their website and look up for the contact info. Sometimes if you contact [email protected], they can take care of it. But wait, thats not all, you should also do a "tracert" (without quotes) in the command prompt on the IP address. In one of the last 2 hops there should be another name. That is also the hosting company. Most likely it will be the same as the one you found using the WHO IS search. But sometimes they are different. This is because the hosting company you found in the WHO IS search could be basically the ISP of the ISP of whoever sent you the unwanted email. Or they own the IP address ranges that the ISP (of whoever sent you the email) uses. If this is the case find their contact information by going to their website and send an email to them and the company you found using the WHO IS search. Be sure to send a polite email. Most likely they will ask you to send them an attachment of the unwanted email for proof.

Hope this helps and sorry for the sloppy grammer ;).

A friend of mine from school was actually receiving emails with viruses attached from a computer at my school. He tracked it down to the exact computer, updated the anti-virus software and ran it. Sure enough it had a virus. Apparently some students are checking email instead of listening in class. Anyways, he went to the IT department with his evidence and I guess they took care of it. Hopefully now they update their AV software more often. It was probably once a week at the time of the incident. If the originating ip of the email had not been from the school I go to, I'm sure that wouldn't have been possible to get to the exact computer sending the infected emails. Got lucky that time I guess. His AV software was catching the emails, but apparently this computer was sending emails in his name to other people, and I think that's what got him going on this vigilante mission. lol. Anyways, thanks for the info.

No problem ;). This info wont trace the IP right to the EXACT computer, but will trace it to their router and thats enough to get thier ISP. And when someone is abusing the worlds email system, an ISP is usually all you need.

In addition, for those in the windows world looking for a good all in one solution, check out NeoTrace. It's now owned by mcafee (http://www.mcafeestore.com) and can be had for around 30 bucks US.... I'tll do a ping trace and a whois for ya with all the contact info you probably dont want or need. Mailing abuse in retort to spam tends to be too cumbersome after a while, but in some cases it gets the job done.

As a note, I've rolled this out to a few people who confirm E-commerce orders with it, if someone is shipping to texas but they're IP traces out to Lagos... well it makes for an easier way of avoiding fraud.

Yes, I have heard of that program and it seems that people like it alot. I have heard that it will show a map and it will point where in the world that email abuser is, or at least their ISP's location. But im poor lol, WHO IS and tracert in the command prompt is the poor mans neotrace lol :p

I also use an add-on to Zone Alarm that performs similarly (not against spammers though). That was an excellent tutorial -- I learned something new! Yay! Now, if only I can figure out what's with spelling words with numbers....;)

Im glad you learned something new! Zone Alarm does come with a utility that lets you trace the IP address, but its only for computers or hackers that are trying to connect to you. It cant help you with anything Email related. lol, I cant figure out the words with numbers thing either :P I think those "super l33t h4x0rs like to do it though, it makes them sound so super l33t :p

Hmm...I'm gonna have to start spelling my name "J4M35" or something...So is "l33t" like a short form of "elite" or something?

Wow, goes to show how much I know about the culture! *hides face*

l33t 5p34k is when people substitute letters for numbers. and your right, l33t means elite. like l33t h4x0r = elite hacker. It's stupid though I highly recomend you not using l33t 5p34k, If you start using it, especially on this board, you will most likley be flammed and lose respect by the community. When I said this tutorial isnt for the super l33t h4x0r, I was being sarcastic because usually only noob script kiddies flame tutorials.

Indeed, they just need h00k3d on ph0n1c5... :D

Sorry folks, goofy sense of humor today...it's the lack of sleep, really!

lol, hell, maybe I should just give a tutorial on l33t 5p34k muwahahahahahaha!! :eek: lol jk, I wouldnt do that to the community :D

Indeed, I think that's among the things I probably don't want to know!

So, on the flipside of this topic, what are the best ways to make your IP "untrackable" (if there is such a thing)? I've read about various tools here and there, just curious. Isn't this where tools such as multiproxy come into play?

You can always use an anonymous proxy mail server. You can mail whatever you want to whoever you want, but most of them will say "From: anonymous" because there was a problem with people saying stuff like "From: [email protected]" lol. And you cant send attachments unless you sign up for a special service that will let you, there are also services that if you sign up, they will encrypt your email, I think its called something like ziplip.com, not sure. If you want me to tell you of a good anonymous server I know, tell me and ill PM you, cause I dont want malicious people using it for bad reasons. You can do alot more with anonymous proxies then you may think and for that reason I dont want to promote them ;).

Duck, I have a trial version of NeoTrace on my comp. I don't remember when I got it, but it's expired now but it works for thirty days. It's pretty fun just to play around with you aught to look for it. Good fun for an hour or two just seeing the visual tracing happening. The hops mean a lot more when you see 'em on a map than when you see them in a terminal. Makes you really see how far away it has to go sometimes to get to somewhere. It's usually nowhere near a straight line.

Wow thats pretty cool! I'll have to look into that trial verson. Where did you get it? I guess I can google it, but should I look for any site in particular? Like maybe a more trustworthy site?

I got mine straight from McAfee... Don't know if they still offer it however.

Well, thanks for the info anyway, atleast now people that visit this thread know that free trials exist for such a fun and reliable program. If I find a website that offers a free trial I will edit the tutorial and add it at the bottom :cool:

I am not going to make a comment on your tutorial as there have been several made already. I just have one favor to ask PLEASE seperate you your paragraphs, it is annoying as hell trying to read a whole tutorial that is just one big ass sentence/paragraph.

Please, I beg of you.

Fine, it seems like a few people either do not like the way I wrote the tutorial or just doesnt like the tutorial all together. I will rewrite tutorial, hopefully that will make it easier to read. I dont know when the new version will be up. Maybe later today or tomorrow.

Quote:

---

Originally posted here by whizkid2300
I am not going to make a comment on your tutorial as there have been several made already. I just have one favor to ask PLEASE seperate you your paragraphs, it is annoying as hell trying to read a whole tutorial that is just one big ass sentence/paragraph.

Please, I beg of you.

---

Give the Guy a break Whiz, I think it is a fine Tut. He will get better at it. :D

It is short enough to be understood for what it is by <sarcasm> most </sarcasm> people. ;)

This tutorial is interesting, but I want to track them back to the machine they sent the emails on. Any suggestions?

I have gotten a lot of positive feed back from the community about my tut. For this reason I have decided to not let the oppinion of 2 people get to me. I will not rewrite this tut because aeallison is right. It is short enough to be able to read just fine. For those guys who have gave me compliments and stuck up for me, thank you :) . For those people who negged me, Im sorry I can't please everyone, but I will make my next tutorial better :) .

Quote:

---

Originally posted here by auxnymph
This tutorial is interesting, but I want to track them back to the machine they sent the emails on. Any suggestions?

---

afaik, the only way is if you're on the same network as the machine that originally sent it, or if you're a cop or work at the isp that provides the net access for the machine that sent the message. in the first case, there should be some common trait in the way ip's are assigned. For example one room may be 192.168.0.100-120. Also, most routers will tell you the name of the computer an ip is leased to, then if you did a good naming scheme you can easily find the computer on the network. The other instance of being a cop with a warrant or working at the isp: If you're a cop you can talk to someone who can give you the info of which address(physical like a street address) of the owner of that ip. And if you work there you can get the info yourself.

Heretic's answer actually depends upon the ISP. Read the mail headers from the bottom up. You will often find that the first, (ie, last), "received from" will be prior to an actual mail server, (actual mail servers usually are reverse DNSable, (think I just invented a word :D ), thus it will show in the by portion of the received from line as both an IP and a FQDN. For example:-

Received From 192.168.1.1 by 208.xxx.xxx.xxx (mailserver.theirISP.com) at ............

It might have a private address, (192.168 etc.), as the received from address which tells you the ISP NAT's the traffic an the sending host is not publicly available but often the host is publicly available.

In increasing cases ISP's are not reporting the originating station so Heretic is quite right but it always pays to read the mail headers. In the case of viruses you will almost always see the IP of the originating station because the receiving mail server, (your ISP's), treats it as a mail server itself and reports the IP. That should at least give you a clue as to who might have sent it.

indeed, and a firewall such as norton's Personal Firewall will actually tell you the city the IP is located in. It is remarkably accurate for what i've seen. (It told me what hotel cheyenne was staying in :) during some xperiements.) Well it told me where the domain resided, and the DNS was under "something HILTON HOTEL, and the address. Of course that will not be the case for personal computers, instead it will mention where the server is located.

I've actually been getting scanned for netBus from the same IP in my ISP for the past week...and its not a zombie. Norton tells me he's in Cambridge, but if I put my IP there, it will say the same...which is the city next to me.