Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is someone harassing me through emails and I need to know if there is a legal/legitimate way I can obtain their true IP address. They started masking their IP address after I used the email header to find out who it was initially. But now I'm at a loss. Any advice or suggestions or help would be tremendously appreciated. Thank you for your time.

share|improve this question

closed as off-topic by Michael Kjörling, Carl B, Mokubai, Nifle, surfasb Sep 18 '13 at 1:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question is not about computer hardware or software, within the scope defined in the help center." – Michael Kjörling, Carl B, Mokubai, Nifle, surfasb
If this question can be reworded to fit the rules in the help center, please edit the question.

Might I suggest ignoring the emails and marking them as spam? also what is a true IP I mean I can guarantee these emails came from a computer with the IP address of not sure how that would help in any way though – 50-3 Sep 17 '13 at 8:23
You need to speak to a lawyer not randoms on the internet ifyou feel their is a breach of your pprotection order. – 50-3 Sep 17 '13 at 8:41
@ Jan Ignoring or automatically deleting the emails is not an option. I'd rather not discuss why. Just looking for suggestions on finding out the IP of someone that is emailing me with a masked IP. If there is a way, I would love to learn more. Thanks :) – helplessly_harassed Sep 17 '13 at 9:02
5… this might help its offtopic – BlueBerry - Vignesh4303 Sep 17 '13 at 9:26
@helplessly_harassed - Allow the police to determine if he is harassing you. If he has a history of doing it, they can determine its him, but the way he writes statements. Furthermore if somebody is masking their ip address, then their ip address is masked, thats the entire point of masking you ip address. Have you thought about changing your email address? I am not saying ignore the emails you get but just don't use that contact for important stuff. – Ramhound Sep 17 '13 at 11:02

I'm a forensics major, and I'd say "no, not really". I'm assuming you're looking at the header and the information from there.

Its painfully simple to run things through a proxy to hide your actual IP address.

There's a few possible scenarios here - lets talk about the most obvious - he's using a proxy service, tunneling things through there and the ip address you're seeing is the proxy service's. In which case you may be able to trace the IP back to the proxy service, and from there, get legal advice to reveal the guy - not very likely to happen.

A slightly more advanced option would be to take advantage of an open relay, (which dosen't really work these days) or to use an anonymous mailing service - there's lots on google.

Email is an old protocol from a more innocent time, and dosen't really have a strong way to determine identity. As I said, its nearly impossible to track, through purely technical means available to an individual, someone who is trying to hide his identity.

A lot of forensics is about people - if you already have emails linking back to him, and the new ones have similar content, you might still be able to get someone to check up on him. Unfortunately the solution here is likely to be legal or social rather than technical.

share|improve this answer
This is one of those times I wish I could use my daily vote cap on one post. Thank you for taking the time to write this I was struggling try to respond from my phone – 50-3 Sep 17 '13 at 13:07
I'm not 100% sure of your answer, remember that TOR is not 100% secure anymore because there's a JS that can reveal your true identity. – jcho360 Sep 17 '13 at 18:36
My understanding is that very nearly EVERYTHING in the headers can be forged (?). The harder part (from a forger's perspective) is preventing third party servers from adding their own information. – horatio Sep 17 '13 at 20:50
@jcho360: only cause folk were using a flawed, older version, and the party attacking had considerable resources. I kind of doubt the OP has the technical skill to do, what was essentially a 0 day attack on a specific tor client. I also purposely specifically did not mention tor - in this case, just any proxy, and a variety of them would make more sense rather than using the same service. – Journeyman Geek Sep 17 '13 at 23:52

This question is veering seriously off topic. The answer depends upon the country in which you are located. Each country has its own laws regarding this.

The simplistic answer would be yes you can get the IP address provided you have a court order. Your only realistic solution is to consult a solicitor.

share|improve this answer
I'm in the USA. The stuff about protection orders and whatnot was only referred to exclusively due to the fact that I need it to be understood that suggestions of ignoring the emails is not an option and won't help me as an answer. I simply need to know how to find the masked IP behind all of this :) I would have retained legal representation if I had the money. Anyway, back to the topic there perhaps something buried in the email header that can help point me in the right direction of finding the originating IP? Anything like that? Totally not my area of expertise.. – helplessly_harassed Sep 17 '13 at 9:19
@helplessly_harassed - You're assuming he has an IP. He could be using a different public WiFi access point every time. – Daniel R Hicks Sep 17 '13 at 20:41

Actually NO. You as an individual can't trace the email sender who is "hiding". There is lot of open proxy servers, which allows to hide IP address, one can use linux TOR services, which disables even authorities to get in, one can send email through open mailserver outside of States... there is plenty ways how to do it. If the sender is clever nothing will help you to get his identity, including police, courts, etc.

If it is about regular spam

If it is about regular spam, experience of many IT specialists is, that best way how to handle with spam is to delete it and further prevent it - not to behave to be spammed again (not to send large group emails and ask to not be included in large group emails, not to answer to spam, not to click to be removed from sending the spam, etc. - all this guides to the fact that you succeed to get to higher level: they will know, that your email is active and you will get even more spam)

If the emails are personal

If the emails are personal, usually the same or similar, someone is stalking you and emails are targeted to your personally, contact police as this could be potentially dangerous. Consider, that it is not up to you to identify the sender, it is job of the police/court. Definitive proof could be obtained when outbox of the sender's computer contain your emails. But there is plenty ways how to send email, so keep it in outbox would be stupid. Most probably you could identify such sender by content of his/her first emails in comaprison with content analysis of current emails. The rule "if it writes as a dog, barks as a dog, makes poo as a dog smells as a dog, it WILL be a dog" is still valid.

share|improve this answer

Please note, the following suggestions are for research purposes only, and are only to be attempted on systems/targets under your control in jurisdictions where they are not expressly prohibited by law. That being said, I would recommend sending an attachment such as a PDF with an embedded link in reply to the message(s) which you have wrapped in some kind of analytics service, such as or When the user opens the link in the default browser you can get the IP address he/she is browsing from. If he is using a VPN or SOCKS5 proxy, such as Tor, you will not get his/her actual IP. However if he/she has Flash or Java enabled, you can determine his/her non-proxied IP address (unless he/she is using a properly configured VPN provider or proxied Virtual Machine). You may also be able to circumvent the malicious user's attempt of hiding his/her origin using newer HTML5 technologies such as WebRTC (if supported), as well as ActiveX (if he/she is using Internet Exporer, and ActiveX controls are enabled).


WebRTC Local Network Exploration (not exactly what you are looking for, but related):

If you have a webserver of your own with PHP support you can write a simple logging script which checks headers, referrers, and checks for X-FORWARDED-FOR to attempt to reveal more information. There is also the BeEF (browser exploitation framework), which can be embedded into a page in an attempt to enumerate the target browser.

There are more links I could post, but lack sufficient privileges to do so with my StackOverflow account. Please Google them to obtain more information.

Hope this helps, Daniel Popp

share|improve this answer
Most ecommerce emails embed an image link to an image on their server which logs the ip of the recipient if they have image viewing enabled in their email program, and the email program retrieves the image for display. This is not illegal to the best of my knowledge, and is trivial to create a single-purpose script for. Usually, the email list software they use creates a special ID which is passed as part of the image link and that way the ecommerce site knows which people put eyes on their mailings. – horatio Sep 17 '13 at 20:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.