Program to locate an IP address

Printable View

September 2nd, 2005, 03:22 AM
J_K9

Program to locate an IP address

Hi,

I recently received a curious email which I would like to investigate further. I discovered the several IP addresses from the header, and also the mail server it was sent from (which, unsurprisingly, was owned by Wanadoo - as the email address ended in @wanadoo.fr). The mail server is based in Ile-de-France, Paris, but that is slightly irrelevant.

Also, does the following bit of the header mean that the sender was in the GMT-7 time zone?

Code:

Received: from smtp12.wanadoo.fr (smtp12.wanadoo.fr [193.252.22.20]) by mx.gmail.com with ESMTP id a2si1016358rnf.2005.09.01.13.39.14; Thu, 01 Sep 2005 13:39:15 -0700 (PDT)

And the IP above (193.252.22.20) is one of two in the header (but it is just the IP of the SMTP server), and the other seems to be (AMarseille-152-1-51-85.w83-201.abo.wanadoo.fr [83.201.1.85]), but that is also part of Wanadoo...so where is the sender's IP?

Thanks! :D

edit: Sorry about the thread's title - that's meant to be once I've already found out the sender's IP, and would just like to keep a tab on it until it becomes active, when its location can be pinpointed. ;)
September 2nd, 2005, 06:44 AM
Triad

try and get ahold of an earlier version of NeoTrace when it was a free demo etc.
http://www.neotrace.com/
see waht that gives you.
September 2nd, 2005, 07:05 AM
Computernerd22

Quote:

Program to locate an IP address

You don't need a program to locate an IP address. A website such as www.ip2location.com will locate an IP address for you.

83.201.1.85 = FR FRANCE ALSACE STRASBOURG IP2000-ADSL-BAS

Next useful information would be a simple WHOIS query on the IP address 83.201.1.85 results are:

% Information related to '83.201.1.0 - 83.201.1.255'

Quote:

inetnum: 83.201.1.0 - 83.201.1.255
netname: IP2000-ADSL-BAS
descr: BSMAR152 Marseille Bloc 1
country: FR
admin-c: WITR1-RIPE
tech-c: WITR1-RIPE
status: ASSIGNED PA
remarks: for hacking, spamming or security problems send mail to
remarks: [email protected] AND [email protected]
mnt-by: FT-BRX
source: RIPE # Filtered

role: Wanadoo France Technical Role
address: WANADOO FRANCE
address: 48 rue Camille Desmoulins
address: 92791 ISSY LES MOULINEAUX CEDEX 9
address: FR
phone: +33 1 58 88 50 00
e-mail: [email protected]
admin-c: WITR1-RIPE
tech-c: WITR1-RIPE
nic-hdl: WITR1-RIPE
mnt-by: FT-BRX
source: RIPE # Filtered

Looks like ISP is IP2000-ADSL-BAS. Now as far as;

Quote:

Received: from smtp12.wanadoo.fr (smtp12.wanadoo.fr [193.252.22.20])
by mx.gmail.com with ESMTP id a2si1016358rnf.2005.09.01.13.39.14;
Thu, 01 Sep 2005 13:39:15 -0700 (PDT)

I will attempt to read this header for you. Where it says

Quote:

"Received: from smtp12.wanadoo.fr"

this is the senders mail server --->smtp12.wanadoo.fr = 193.252.22.20 now where it says by

Quote:

"mx.gmail.com"

did you recieve this email in gmail? ;)

Now, where it says

Quote:

with ESMTP id a2si1016358rnf.2005.09.01.13.39.14

ESMTP is Extended Simple Mail Transfer Protocol, which allows transfer of graphics, audio, video files.

Quote:

2005-09-01 13.39.14= 1:39pm

Is obviously date and time. Can you post the complete email headers just to double check. Hope this helps
September 2nd, 2005, 09:15 AM
BrainStop

Re: Program to locate an IP address

J_K7,

Quote:

Also, does the following bit of the header mean that the sender was in the GMT-7 time zone?

Code:

Received: from smtp12.wanadoo.fr (smtp12.wanadoo.fr [193.252.22.20]) by mx.gmail.com with ESMTP id a2si1016358rnf.2005.09.01.13.39.14; Thu, 01 Sep 2005 13:39:15 -0700 (PDT)

I would be tempted to say that it was received at 13:39 Pacific time by the Gmail server. And I just checked on Gmail, and that's the case. The header tells you when the email was received by your mail server, and it includes the time settings for that mail server.

So no, it doesn't say anything about the sender's timezone.

Cheers,

BrainStop
September 2nd, 2005, 10:18 AM
XTC46

those IP locater programs are very flawed...just a heads up. they gve you the registered address of the company who provides your IP address. Mines shows up in texas...im far from texas.
September 2nd, 2005, 11:18 AM
J_K9

Yeh, mine shows up in the Netherlands, and I'm FAR from there! :P

Computernerd22: Sorry for not explaining myself properly (:D) - the reason I was looking for a program was because, IF I were able to find out the sender's IP, I would like to trace the IP every few minutes. This would be assuming that the IP address is static, and that the sender doesn't have a dynamic one (that is the case around here with broadband users, and that's another thing I'm also assuming - that the sender's using a broadband account). If they're using 56k, then the IP will most likely be dynamic, yet if they are using broadband they may have a static IP - which means that I can trace them! That's why I was looking for a program rather than a site, because then I could set it to refresh every few minutes and retrace the IP until it became active. ;) I also don't know enough about scripts to use one of the sites to my advantage in this way! ;-D

Oh, and I did indeed receive it in Gmail! As for the time...

Quote:

Thu, 01 Sep 2005 13:39:15 -0700 (PDT)
Further on...
{forwarded on to my account} Thu, 1 Sep 2005 22:39:13 +0200 (CEST)

BrainStop: Yet, why would the Gmail servers be receiving it in Pacific time? Is there a slight chance that it did because that is the sender's timezone (I know I'm probably wrong, but if I'm right, then I've solved the mystery and this person isn't who they say they are)!

XTC: I know...some of them tell me where I actually am, but VERY few! Hehe...

P.S Thanks everyone for you help so far!
September 2nd, 2005, 11:31 AM
BrainStop

Timestamp

J_K9,

The GMail servers are located in California, and probably run on Pacific time.

I sent an email from my Swiss ISP to my Gmail account and it showed up with the same PDT timezone in the headers.

Cheers,

BrainStop
September 2nd, 2005, 11:52 AM
Katja

The -0700 is the timestamp for the GMail server, based upon GMT, normally. (A nice wiki can be found at http://en.wikipedia.org/wiki/Coordinated_Universal_Time and information about this standard at http://www.w3.org/TR/NOTE-datetime )
The -0700 suggests the location relative to GMT. And the (PDT) tells the local time format used at that location. Which in this case is Pacific Daylight Time. Since PDT includes the daylight time saving this value is +1 hour from Pacific Standard Time. (PSD is -0800)
However, the mailserver is following a specific time format (Coordinated Universal Time) which is always without daylight saving and relative to GMT.

It is not the sender's timezone. It's the timezone of the Google mailserver.

Wanadoo.fr is a french ISP providing services to a large part of Western Europe. They provide telephony, ADSL, cable and several other services. They are part of France Telecom, btw. And a pretty big player here too.
September 2nd, 2005, 12:17 PM
Broomiebar

Short Tutorial

You Should find all the answers at
www.stopspam.org/email/headers.html
September 2nd, 2005, 07:55 PM
Computernerd22

One of my favorite sites for Mail relay testing is http://www.abuse.net/relay.html and also http://spamcop.com/ for future references of course.
September 3rd, 2005, 02:31 AM
slinky2004

you could see if the ip, looks like 83.201.1.85 is the sender's ip to me, is from a mapped network. my isp is mapped and when i see those "find sexy singles in <your area>" ads on web pages, they're usually accurate.
September 3rd, 2005, 08:42 AM
protocool

windows?
one word "NETSTAT"
i hope there still netstat on ur box... ;-)
September 3rd, 2005, 09:26 AM
HTRegz

Hey Hey,

Quote:

Originally posted here by protocool
windows?
one word "NETSTAT"
i hope there still netstat on ur box... ;-)

WTF does netstat have to do with an email header from a gmail account... and all the addicts complain about other members...

So far Computernerd22 is the only one that's actually answered any questions (too bad I'm outta APs for the day), however others have added some interesting points.

J_K9... Why would you want to know when they come online? It's not going to accomplish anything... Anyways... the odds are that with DSL of any sort they don't have a static IP... There either authenticating over PPPoE and receiving a dynamically assigned IP Address in an IPCP packet or they're connected as soon as they hit the DSL and are working with DHCP... receiving the addresses by sending out a DHCP Request. Either way the address will dynamic (PPPoE more so than DHCP because the leases are most likely set to be quite long)... Anyways... Basically what you're looking for is a keep alive program... something that will continuously send a PING to the host in question... These are flawed for a number of reasons, especially if you're just going to use a home PC.... It could be firewalled, the ISP might not allow PINGs to hosts and it could be viewed as Denial Of Service (although not really denying the service and could violate your ToU or trigger an alarm in the security department of one of the ISPs)... You received spam... welcome to the club.... Hit that junk mail button and continue on with your day.. You aren't going to learn anything... and it's not going to benefit you.... There are better things you could do with your time.

Peace,
HT
September 3rd, 2005, 10:53 AM
J_K9

Thanks for all the replies! I've been a bit too busy lately! :D Anyway, in reply to HT:

Why would you want to know when they come online?

Sorry, that's not what I meant...what I was trying to say was that I was trying to find a program which would constantly ping the IP until it was found to be active (but if it has a decent firewall it will just drop the ICMP packets) - yet, this is pointless, because I don't even know their IP! :P slinky2004: 83.201.1.85 is another Wanadoo IP - one of their servers, if I'm not mistaken...

As for the sender having a dynamic IP address - I bow down to you, almighty HT! :D Maybe it's because of the fact that so few people here use DSL that we use PPPoA (with static IPs), that's why I incorrectly assumed that most DSL users had static IPs. Hehe! Well, thank you for correcting me, and I guess I've learned something!

I don't think my ISP would view a series of pings as an attempt at Ping Flooding or DoS, because of the fact that they're so rubbish! I literally lose my internet connection approximately once every day, and the technicians there are pathetic (whenever I call them up asking them what's wrong, they tell me that there's something wrong with their servers - and they've caught more than one virus and trojan in the past!). Theirs could though, as you said.

Hit that junk mail button and continue on with your day..

You're right! Plus (I know this is a number one rule of what NOT to do) I already replied to them, because it wasn't really a spam email - it was a "Hi, how are you? How's everything over there?" one, and the person was called the same name as one who I recently gave my email address to (I'm not actually sure if I did or not). Although, it could just be spammers trying to check if my address was active, but I doubt it. The email was just too personal...

Thanks everyone for all your help! I've really learnt a lot from this thread, so thank you! ;)