There is someone harassing me through emails and I need to know if there is a legal/legitimate way I can obtain their true IP address. They started masking their IP address after I used the email header to find out who it was initially. But now I'm at a loss. Any advice or suggestions or help would be tremendously appreciated. Thank you for your time.
closed as off-topic by Michael Kjörling, Carl B, Mokubai♦, Nifle, surfasb Sep 18 '13 at 1:43
This question appears to be off-topic. The users who voted to close gave this specific reason:
I'm a forensics major, and I'd say "no, not really". I'm assuming you're looking at the header and the information from there.
Its painfully simple to run things through a proxy to hide your actual IP address.
There's a few possible scenarios here - lets talk about the most obvious - he's using a proxy service, tunneling things through there and the ip address you're seeing is the proxy service's. In which case you may be able to trace the IP back to the proxy service, and from there, get legal advice to reveal the guy - not very likely to happen.
Email is an old protocol from a more innocent time, and dosen't really have a strong way to determine identity. As I said, its nearly impossible to track, through purely technical means available to an individual, someone who is trying to hide his identity.
A lot of forensics is about people - if you already have emails linking back to him, and the new ones have similar content, you might still be able to get someone to check up on him. Unfortunately the solution here is likely to be legal or social rather than technical.
This question is veering seriously off topic. The answer depends upon the country in which you are located. Each country has its own laws regarding this.
The simplistic answer would be yes you can get the IP address provided you have a court order. Your only realistic solution is to consult a solicitor.
Actually NO. You as an individual can't trace the email sender who is "hiding". There is lot of open proxy servers, which allows to hide IP address, one can use linux TOR services, which disables even authorities to get in, one can send email through open mailserver outside of States... there is plenty ways how to do it. If the sender is clever nothing will help you to get his identity, including police, courts, etc.
If it is about regular spam
If it is about regular spam, experience of many IT specialists is, that best way how to handle with spam is to delete it and further prevent it - not to behave to be spammed again (not to send large group emails and ask to not be included in large group emails, not to answer to spam, not to click to be removed from sending the spam, etc. - all this guides to the fact that you succeed to get to higher level: they will know, that your email is active and you will get even more spam)
If the emails are personal
If the emails are personal, usually the same or similar, someone is stalking you and emails are targeted to your personally, contact police as this could be potentially dangerous. Consider, that it is not up to you to identify the sender, it is job of the police/court. Definitive proof could be obtained when outbox of the sender's computer contain your emails. But there is plenty ways how to send email, so keep it in outbox would be stupid. Most probably you could identify such sender by content of his/her first emails in comaprison with content analysis of current emails. The rule "if it writes as a dog, barks as a dog, makes poo as a dog smells as a dog, it WILL be a dog" is still valid.
Please note, the following suggestions are for research purposes only, and are only to be attempted on systems/targets under your control in jurisdictions where they are not expressly prohibited by law. That being said, I would recommend sending an attachment such as a PDF with an embedded link in reply to the message(s) which you have wrapped in some kind of analytics service, such as bit.ly or goo.gl. When the user opens the link in the default browser you can get the IP address he/she is browsing from. If he is using a VPN or SOCKS5 proxy, such as Tor, you will not get his/her actual IP. However if he/she has Flash or Java enabled, you can determine his/her non-proxied IP address (unless he/she is using a properly configured VPN provider or proxied Virtual Machine). You may also be able to circumvent the malicious user's attempt of hiding his/her origin using newer HTML5 technologies such as WebRTC (if supported), as well as ActiveX (if he/she is using Internet Exporer, and ActiveX controls are enabled).
WebRTC Local Network Exploration (not exactly what you are looking for, but related): https://dl.dropboxusercontent.com/u/1878671/enumhosts.html
If you have a webserver of your own with PHP support you can write a simple logging script which checks headers, referrers, and checks for X-FORWARDED-FOR to attempt to reveal more information. There is also the BeEF (browser exploitation framework), which can be embedded into a page in an attempt to enumerate the target browser.
There are more links I could post, but lack sufficient privileges to do so with my StackOverflow account. Please Google them to obtain more information.
Hope this helps, Daniel Popp