There is someone harassing me through emails and I need to know if there is a legal/legitimate way I can obtain their true IP address. They started masking their IP address after I used the email header to find out who it was initially. But now I'm at a loss. Any advice or suggestions or help would be tremendously appreciated. Thank you for your time.
asked Sep 17, 2013 at 8:19
4 Answers
I'm a forensics major, and I'd say "no, not really". I'm assuming you're looking at the header and the information from there.
It's painfully simple to run things through a proxy to hide your actual IP address.
There's a few possible scenarios here - lets talk about the most obvious - he's using a proxy service, tunneling things through there and the IP address you're seeing is the proxy service's. In which case you may be able to trace the IP back to the proxy service, and from there, get legal advice to reveal the guy - not very likely to happen.
A slightly more advanced option would be to take advantage of an open relay, (which doesn't really work these days) or to use an anonymous mailing service - there are lots on Google.
Email is an old protocol from a more innocent time, and doesn't really have a strong way to determine identity. As I said, it's nearly impossible to track, through purely technical means available to an individual, someone who is trying to hide his identity.
A lot of forensics is about people - if you already have emails linking back to him, and the new ones have similar content, you might still be able to get someone to check up on him. Unfortunately the solution here is likely to be legal or social rather than technical.
answered Sep 17, 2013 at 10:21
-
This is one of those times I wish I could use my daily vote cap on one post. Thank you for taking the time to write this I was struggling try to respond from my phone– 50-3Sep 17, 2013 at 13:07
-
I'm not 100% sure of your answer, remember that TOR is not 100% secure anymore because there's a JS that can reveal your true identity.– jcho360Sep 17, 2013 at 18:36
-
My understanding is that very nearly EVERYTHING in the headers can be forged (?). The harder part (from a forger's perspective) is preventing third party servers from adding their own information.– horatioSep 17, 2013 at 20:50
-
2@jcho360: only cause folk were using a flawed, older version, and the party attacking had considerable resources. I kind of doubt the OP has the technical skill to do, what was essentially a 0 day attack on a specific tor client. I also purposely specifically did not mention tor - in this case, just any proxy, and a variety of them would make more sense rather than using the same service.– Journeyman Geek ♦Sep 17, 2013 at 23:52
This question is veering seriously off topic. The answer depends upon the country in which you are located. Each country has its own laws regarding this.
The simplistic answer would be yes you can get the IP address provided you have a court order. Your only realistic solution is to consult a solicitor.
answered Sep 17, 2013 at 9:08
-
I'm in the USA. The stuff about protection orders and whatnot was only referred to exclusively due to the fact that I need it to be understood that suggestions of ignoring the emails is not an option and won't help me as an answer. I simply need to know how to find the masked IP behind all of this :) I would have retained legal representation if I had the money. Anyway, back to the topic ..is there perhaps something buried in the email header that can help point me in the right direction of finding the originating IP? Anything like that? Totally not my area of expertise.. Sep 17, 2013 at 9:19
-
@helplessly_harassed - You're assuming he has an IP. He could be using a different public WiFi access point every time. Sep 17, 2013 at 20:41
Actually NO. You as an individual can't trace the email sender who is "hiding". There is lot of open proxy servers, which allows to hide IP address, one can use linux TOR services, which disables even authorities to get in, one can send email through open mailserver outside of States... there is plenty ways how to do it. If the sender is clever nothing will help you to get his identity, including police, courts, etc.
If it is about regular spam
If it is about regular spam, experience of many IT specialists is, that best way how to handle with spam is to delete it and further prevent it - not to behave to be spammed again (not to send large group emails and ask to not be included in large group emails, not to answer to spam, not to click to be removed from sending the spam, etc. - all this guides to the fact that you succeed to get to higher level: they will know, that your email is active and you will get even more spam)
If the emails are personal
If the emails are personal, usually the same or similar, someone is stalking you and emails are targeted to your personally, contact police as this could be potentially dangerous. Consider, that it is not up to you to identify the sender, it is job of the police/court. Definitive proof could be obtained when outbox of the sender's computer contain your emails. But there is plenty ways how to send email, so keep it in outbox would be stupid. Most probably you could identify such sender by content of his/her first emails in comaprison with content analysis of current emails. The rule "if it writes as a dog, barks as a dog, makes poo as a dog smells as a dog, it WILL be a dog" is still valid.
Please note, the following suggestions are for research purposes only, and are only to be attempted on systems/targets under your control in jurisdictions where they are not expressly prohibited by law. That being said, I would recommend sending an attachment such as a PDF with an embedded link in reply to the message(s) which you have wrapped in some kind of analytics service, such as bit.ly or goo.gl. When the user opens the link in the default browser you can get the IP address he/she is browsing from. If he is using a VPN or SOCKS5 proxy, such as Tor, you will not get his/her actual IP. However if he/she has Flash or Java enabled, you can determine his/her non-proxied IP address (unless he/she is using a properly configured VPN provider or proxied Virtual Machine). You may also be able to circumvent the malicious user's attempt of hiding his/her origin using newer HTML5 technologies such as WebRTC (if supported), as well as ActiveX (if he/she is using Internet Exporer, and ActiveX controls are enabled).
Java: http://www.frostjedi.com/terra/scripts/ip_unmasker.php?mode=utf16/
WebRTC Local Network Exploration (not exactly what you are looking for, but related): https://dl.dropboxusercontent.com/u/1878671/enumhosts.html
If you have a webserver of your own with PHP support you can write a simple logging script which checks headers, referrers, and checks for X-FORWARDED-FOR to attempt to reveal more information. There is also the BeEF (browser exploitation framework), which can be embedded into a page in an attempt to enumerate the target browser.
There are more links I could post, but lack sufficient privileges to do so with my StackOverflow account. Please Google them to obtain more information.
Hope this helps, Daniel Popp
-
Most ecommerce emails embed an image link to an image on their server which logs the ip of the recipient if they have image viewing enabled in their email program, and the email program retrieves the image for display. This is not illegal to the best of my knowledge, and is trivial to create a single-purpose script for. Usually, the email list software they use creates a special ID which is passed as part of the image link and that way the ecommerce site knows which people put eyes on their mailings.– horatioSep 17, 2013 at 20:43
127.0.0.1not sure how that would help in any way though