Internal IP???

Hello-

I've sent a bugged email to a scammer, and the bug returned an internal IP address. The scammer is based out of Nigeria. I didn't want to risk them seeing the bug, so instead I directed them to a server with PHP with a hyperlink. They viewed the link three times, and each time it showed an internal IP address. I reviewed the email conversations, and they all came from that IP address as well.

The address is 192.168.x.x, and they sure as hell aren't on my network. How did it return an internal address? The webserver shoudn't see an internal addy!

Maybe I'm missing something. Let me know...
Thanks!

Weird, the only way that I know of that you might get an internal IP is with javascript (which I assume you would not use since you one the WAN IP). Did you write the bug yourself, and if so can we see the source? Is it like the ones I have here:

http://www.antionline.com/showthread...hreadid=263046

PHP Code:

---

<?php

$to = "myemail";

$IP = $_SERVER['REMOTE_ADDR'];
$UA = $_SERVER['HTTP_USER_AGENT'];

$body = "Image viewed by " . $IP . " on " . date("D dS M,Y h:i a");
$subject = "Image has been viewed with a " . $UA;

mail($to, $subject, $body);
?> 


---

I didn't touch javascript, I used PHP for the job. It runs over email like my tut here:
http://www.antionline.com/showthread...hreadid=260660

There's no reason it should be giving me an internal addy. I've been using these for a long time and it's the first time I've seen this.

Very weird. You could PM a link to your bug and see what it returns when I hit it from my box behind a NAT router.

Just a question Soda_Popinsky, What's your success rate in finding a spammers real IP and ISP using this technique? And when you do, do you report them? And if so whats your success rate in actually getting them kicked off their ISP or at least having their ISP telling them not to spam you anymore? I'm guessing you havn't had anymore luck then I have, since I'v been fighting spammers for a very long time and most ISP's tend to ignore me :(...

I have some email honeypots set up, but because of the way I've planted their email addresses on the internet I don't really get much spam. It's almost 100% scams, about 15 a day.

I also have jackpot honeypots set up, more on that here:
http://jackpot.uk.net/
http://www.antionline.com/showthread...hreadid=265780

But they don't get much attention. I haven't found a good way to advertise their presence yet. As for pursuing these things, owned servers I can get taken offline almost immediately by contacting their owners or ISP, Scammers- I prefer to convince them to quit their job. Spamming is a hard one to go after.

Check your PM's Irongeek.

Well, from the PM you got an IP from my ISP. I'm afraid that shed no light on the subject. By the way, I did some more looking and it seems I’m behind two NAT boxes (my routers wan is 10.x.x.x). I have no idea what's going on, sorry.

Quote:

---

Originally posted here by The Duck
...since I'v been fighting spammers for a very long time and most ISP's tend to ignore me :(...

---

- The Duck, I share the feeling of being ignored and come to think of it that we had wasted our time just to report such things. BTW, free E-Mail spam filter really is bugging me!

Yo!

I have no idea how they did that. Some people like to brag though. Why not send them another email asking them how they appear to be browsing from a 192.168.x.x address? They probably know how they're doing it, whereas in all likelihood nobody here does. It may sound stupid, but it's still worth a shot :).

I would, but I'd give myself away. :) They don't know they're being given the run around yet.

Here's another clue:
The address I received from an email 5 minutes before the notification email is different.

Quote:

---

Received: from [83.x.x.x] by x.mail.ukl.yahoo.com via HTTP; Sun, 13 Mar 2005 11:21:29 GMT

---

The notification email has the 192.168. in the headers and from my PHP remote_addr

Quote:

---

X-MM-Mail-From-IP: 192.168.x.x

---

All previous emails were from 81.x.x.x, 82.x.x.x, 83.x.x.x, however this web bug returned an internal address.

http://yahoo.weblogsinc.com/entry/2498506749651474/

The scammer is on Yahoo! email, my php script is hosted on Lycos. This may have been very odd circumstances...

According to that link and others, Yahoo and Lycos are partnering up for games and messaging. The webserver I'm using and the email he's using are both based out of .uk (lycos.co.uk and yahoo.co.uk)

Is it possible that Yahoo.co.uk changes hyperlinks to something like http://proxy.yahoo.co.uk?addy=http:/...hyperlink/bug, then sends the result to the viewer with the proxy? If so, and depending on the network, is it possible that the proxy never had to leave the network to get to the webhost I'm on, giving my script an internal IP address???

It's a pretty crazy idea... It's all I can think of. I'm going to register for an account to see how it handles it, and if I can replicate the circumstances.

The email he's using may be yahoo.co.uk but he's still not reading it from yahoo.co.uk, he's on his box wherever. And your bug picks up his ip, not the email server's correct?

I was thinking earlier, he may have a local email server that he checks using the local ip, but then it occurred to me that you would still get his internet ip from the bug, or would you? I guess since it's a yahoo account then yes, but I don't know. So those 8*.x.x.x addresses are proxies or what? And what are you going to do if you get an ip that you do or don't know is his?

Quote:

---

And your bug picks up his ip, not the email server's correct?

---

If he clicks the link in the email, and a browser opens up- I have his IP. However, my theory was that yahoo may have changed the link to redirect through a proxy (sortof like a frameset, proxify?) however I registered an account with yahoo.co.uk and this isn't the case. My theory is shot down because it gave me my correct IP address.

Quote:

---

I was thinking earlier, he may have a local email server that he checks using the local ip, but then it occurred to me that you would still get his internet ip from the bug, or would you?

---

It could be that he is downloading his email over POP3 or something, however in the end it's just a hyperlink and it should open his browser. In fact, I got his User Agent too:
Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)

Plus this header:
Received: from [83.x.x.x] byx.mail.ukl.yahoo.com via HTTP; Sun, 13 Mar 2005 11:21:29 GMT

Tells me that he's using the web interface to send receive emails. They very well could be proxies, but I'll save them anyways if I feel like making a formal complaint of some sort.

sounds like he is using a proxy. I mean the guy is a spammer, Im sure he is somewhat cautious to hide his true IP address.

A proxy would be my guess too..

Why don't you just check the weblogs? Or are these not available?
These definitely should contain his/her Internet IP.

Have a look at the user comments at http://nl3.php.net/getenv.
Seems you're not the first to encounter this.

Quote:

---

my php script is hosted on Lycos.

---

- Soda_Popinsky, hello! One question, what if somehow, these people were wise enough to trace your script (the source) and could probably doing a reverse tracing with you right now? I mean, come to think of the idea that these scammers (in one point) knew the work-around in web servers and such.

I don’t like to think of the situation this way but I am also interested about this concept of tracing the bad guys using your own tools, but I could not figure out any ideas aside from the scammers maybe using multiple proxy for anonymity (just like what the other AO guys are thinking).

And about the thread link here for Irongeek’s tut, I’ve also been reading about tracing/tracking website visitors but most of the ideas I had read is using third-party web analyzer doing the job for you, but your tut, as well as Soda_Popinsky’s, really is helpful for webmasters and other analyst to use it in good ways.

Going back to the topic, mostly scripts for web pages (specifically javascript) could only return the IP of proxy (if it exist), right? But in this case, for the e-mail bugger, returning a local IP add is a BIG challenge to be answered.

BTW, guys, I cannot test your tuts right now, since I don’t have resources to do so (properly configured web server, honeypot, etc.), but I am eager to learn more of this when I go back home. Maybe I’ll continue and go on reading some of the links you had provided.

Hope you solve the local IP dilemma thing soon.

Yo!

Quote:

---

sounds like he is using a proxy. I mean the guy is a spammer, Im sure he is somewhat cautious to hide his true IP address.

---

With an IP like that, he would be confusing every device between myself and him and his requests would end up in lala land.

Quote:

---

A proxy would be my guess too..

Why don't you just check the weblogs? Or are these not available?
These definitely should contain his/her Internet IP.

Have a look at the user comments at http://nl3.php.net/getenv.
Seems you're not the first to encounter this.

---

I see some posts about getting their internal IP intentionally, but I don't see one about my problem... I'm probably missing it, but I'm going to try one of their stronger scripts that will get the IP with the proxy.

Quote:

---

One question, what if somehow, these people were wise enough to trace your script (the source) and could probably doing a reverse tracing with you right now? I mean, come to think of the idea that these scammers (in one point) knew the work-around in web servers and such.

---

If they did, they would have to deal with Lycos security, and in the end they will have my transparent email address and nowhere to go ;)

It's not all that unusual for an internal address to appear in a mail header,
if, like me, you haven't figured out how to configure sendmail to rewrite
it as your public address.

Code:

---

Return-Path: <[email protected]>
Received: from norm.shentel.net (acer.localdomain [127.0.0.1])
        by acer.localdomain (8.11.6/8.11.6) with ESMTP id j2F7AOx11458
        for <rcgreen@localhost>; Tue, 15 Mar 2005 02:10:24 -0500
Received: from marlin.shentel.net (marlin.shentel.net [204.111.11.42])
        by norm.shentel.net (8.13.1/8.13.1) with ESMTP id j2F75Sak013871
        for <[email protected]>; Tue, 15 Mar 2005 02:05:28 -0500
Received: from eforward3.name-services.com (eforward3.name-services.com [63.251.83.52])
        by marlin.shentel.net (8.12.11/8.12.11) with ESMTP id j2F75RW8008157
        for <[email protected]>; Tue, 15 Mar 2005 02:05:27 -0500
Received: from seahorse.shentel.net ([204.111.11.44]) by eforward3.name-services.com with Microsoft SMTPSVC(5.0.2195.6747);
        Mon, 14 Mar 2005 23:04:30 -0800
Received: from acer.localdomain (ha96s593.d.shentel.net [204.111.98.81])
        by seahorse.shentel.net (8.12.11/8.12.11) with ESMTP id j2F75P7C018584
        for <[email protected]>; Tue, 15 Mar 2005 02:05:26 -0500
Received: from rcgreen (rcgreen [192.168.0.1])
        by acer.localdomain (8.11.6/8.11.6) with SMTP id j2F76Bx11408
        for <[email protected]>; Tue, 15 Mar 2005 02:06:12 -0500
Message-ID: <000d01c5292d$5ecd30e0$51626fcc@rcgreen>
Reply-To: "Randy C. Green" <[email protected]>
From: "Randy C. Green" <[email protected]>
To: <[email protected]>
Subject: a mail test
Date: Tue, 15 Mar 2005 02:05:28 -0500
MIME-Version: 1.0
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
X-OriginalArrivalTime: 15 Mar 2005 07:04:30.0578 (UTC) FILETIME=[3BF00520:01C5292D]
X-UIDL: /HD"!;[V"!DIT"!iJH!!
X-SpamBouncer: 2.0 beta RC5 (01/31/05)
X-SBScore: 0 (Spam Threshold: 20) (Block Threshold: 5)
X-SBClass: OK
Status: 

check the headers on this.

---

It's a minor blemish, and doesn't affect the delivery of the mail.
You can still see where it is really coming from.
:cool:

Quote:

---

Originally posted here by rcgreen
It's not all that unusual for an internal address to appear in a mail header,

---

Correct. But that's not Soda's problem. Seems he's picking up the internal address in his php script with $_SERVER{'REMOTE_ADDR'}.

So what does this mean? Is the spammer a moron who doesn't know
how to configure his outgoing mail server, or a genius for spoofing
the address?
:cool:

Hi rcgreen

There was no spammer involved.

The scammer opens my email, clicked hyperlink
Hyperlink lead to webserver with PHP script
PHP script grabs the IP and send me an email w/ user agent and IP
IP shown in the email is an internal address

Correction to my initial post:

The internal IP address is not in any of the email conversations. I have no idea why I wrote that.