5 Answers

• Reputation: 42 Q&A: 1 0 0 24 2 0 Classifieds: 0 0 what's this? Follow Following 0

  4 0 a basic method: http://www.wikihow.com/Trace-an-IP-Address It doens't always work, but most of the time you can get some idea. Ryan Parrish answered in Science & Technology over 2 years ago | Report Comment on this answer Enter your comment or ask a new question preview THIS IS A PREVIEW: Click "Post" to submit it or "Edit" to make changes. edit Please wait… This could take a minute if the tubes are clogged.

  Share this answer with a friend:

• Reputation: 18 Q&A: 0 0 0 18 0 0 Classifieds: 0 0 what's this? Follow Following 0 Paul F

  3 0 To a point. You can usually tell if there was trickery involved by carefully tracing up the Received headers. If not, then you can be fairly confident of the originating information up to the originating host, which may or may not be the actual origination of the message. Whenever an email goes through a "hop", or a server on the internet which relays the message from one host to another, a Received: header gets prepended to the top of the message. You can trust the your own ISP's email server (I hope) to do this honestly, and given which email server delivered it to your ISP, you can decided how trustworthy the next hop down was. You can also compare the information between subsequent Received: headers to check for inconsistencies. If the next one down the chain adds up, it is unlikely to be forged at that point. While it is possible to forge originating IPv4 IP addresses, this is hard to do in practice over TCP (the IP protocol carrying e-mail) for larger messages against most modern implementations of TCP. It is far easier for a sender wishing to obfuscate his origination to take advantage of a compromised host. If the true origination of the message is being effectively forged so all the Received: headers add up and the message is still not legitimate, other likely possibilities include the message originating from a compromised or infected host, or a secure anonymizing relay being utilized. Short of some sort of cryptographic signing protocol in place to vouch for the validity of an originating message, you cannot conclusively answer this question because that requires trusting every computer involved that participated in the messages entire path through the internet. A quick Google search on reading message headers came up with one fairly good link to help read Received: headers http://antivirus.about.com/od/windowsbasics/a/emailheaders.htm Paul F answered in Science & Technology over 2 years ago | Report 2 comments by Fnarf and Paul F… 0 0 The problem nowadays is that there's usually only one hop -- from the infected PC to you. So you look it up, and it says it's from an IP number in Verizon's or Shaw's pool. Not much use, since Verizon and Shaw and all the others have no freaking clue how to deal with the millions of infected PCs on their networks, all running illicit MTAs and getting their instructions (spam text and lists of addressses) from elsewhere in the botnet. Fnarf commented over 2 years ago | Report 0 0 This is true (and accounted for in my original answer). But at least now you have identified a bot, which counts for something. Paul F commented over 2 years ago | Report Enter your comment or ask a new question preview THIS IS A PREVIEW: Click "Post" to submit it or "Edit" to make changes. edit Please wait… This could take a minute if the tubes are clogged.

  Share this answer with a friend:

• Reputation: 2 Q&A: 0 0 0 21 19 0 Classifieds: 0 0 what's this? Follow Following 0

  1 0 Not really. While you can maybe track it back to the originating email server, there's no reason to believe that server will report the address of the person who sent it accurately, if at all. The problem with most spam is badly operated mail servers at small sites, often in foreign countries, that don't reliably pass on that information. Keith Tyler answered in Science & Technology over 2 years ago | Report 1 comment by Fnarf… 0 0 A huge amount of spam doesn't even come from email servers at all; it comes from direct-inject infected PCs. It could come from your next-door neighbor's computer. But the real question is, what exactly do you mean by "from"? Do you mean the country in which the person who typed it is sitting? No, you can't tell. If you had an ACCURATE report of their IP number, though, all the way up the chain, you could. But you usually don't. Fnarf commented over 2 years ago | Report Enter your comment or ask a new question preview THIS IS A PREVIEW: Click "Post" to submit it or "Edit" to make changes. edit Please wait… This could take a minute if the tubes are clogged.

  Share this answer with a friend:

• Reputation: 976 Q&A: 26 0 7 566 255 1 Classifieds: 0 0 what's this? Follow Following 0

  0 1 Another good website to search is the ARIN Whois Database http://ws.arin.net/whois/ You can enter most IP addresses and figure out who they belong to. For example: http://ws.arin.net/whois/?queryinput=4.2.2.2 protosaurus answered in Science & Technology over 2 years ago | Report Comment on this answer Enter your comment or ask a new question preview THIS IS A PREVIEW: Click "Post" to submit it or "Edit" to make changes. edit Please wait… This could take a minute if the tubes are clogged.

  Share this answer with a friend:

• Reputation: -153 Q&A: 1 0 0 78 251 0 Classifieds: 0 0 what's this? Follow Following 0

  0 20 Running tracert sometimes works, but can be forged upstream under IP version 4. Upgrade to a real OS and run IP version 6. Will in Seattle answered in Science & Technology over 2 years ago | Report 16 comments by Fnarf, protosaurus, and Fnarf… 0 0 This answer makes no sense. Fnarf commented over 2 years ago | Report 0 0 this answer starts out right with suggesting tracert (aka traceroute) but then descends into nonsense protosaurus commented over 2 years ago | Report 0 0 Except that traceroute doesn't tell you the country of origin. The IP block does, and you already know that (otherwise you couldn't traceroute it, could you?) Fnarf commented over 2 years ago | Report 0 0 IP blocks are literally owned - however when you get to certain ones, they're parted amongst multiple countries. IPv4 does not contain verified headers and thus can only tell you what the (likely forged) header thinks it could be if the upstream originating server isn't lying (which it probably is). Without an IPv6 encrypted server-verified packet, the trust is not established and any such IP information is probably false. Unlike you, I used to turn in spammers back in the 80s you frickin morons. Will in Seattle commented over 2 years ago | Report 0 0 Ooh, you used to "turn in spammers", did you Will? How very brave. Rather implausible, though, since THERE WAS NO SPAM IN THE EIGHTIES. The history of spam starts in the mid-nineties, on Usenet; email came later. And you're hardly the only one who ever submitted a report to Spamcop. All that business about "server-verified packets" is just pure invention; you don't know what you're talking about. IPv6 is an addressing protocol, and doesn't have anything to do with authentication. You still can't trust anything beyond the server that's talking directly to you. Will, your overpowering desire to shoot yourself in the foot and make yourself look stupid really knows no bounds. Fnarf commented over 2 years ago | Report 0 0 Read the IPv6 header and tell me how it doesn't have authentication or verification. While the 90s was the heydey of spam, it did exist before, but was mostly limited to people adverting on UseNet message boards before we broke the newsfeed. Usually first year college students. Will in Seattle commented over 2 years ago | Report 0 0 Oh, for chrissake, Will, STOP. The first Usenet spam was in 1994. Canter and Siegel. I WAS THERE. You apparently were not, since you don't seem to know the first fucking thing about it. You also don't know the first fucking thing about messaging. You apparently think that "forged IPs" in email spam are actually forged, i.e., broadcasting themselves as a different IP number than the one they have. This never happens; as Paul F points out, it's technically possible but difficult and rare. What happens instead is misreporting your identity to the incoming mail server. THIS HAS NOTHING TO DO WITH IPv4 vs. IPv6. You're a piece of work, Will. You appear to have been hanging around the periphery just long enough to hear the grownups talking, and you've picked up a little of the lingo, but you use it wrong, and you DON'T KNOW ANYTHING. Fnarf commented over 2 years ago | Report 0 0 http://en.wikipedia.org/wiki/Newsgroup_spam Fuck off, Will. Seriously. Get fucking lost. Fnarf commented over 2 years ago | Report 0 0 LOL. I started computing at SFU in 1978, nimrod. Even did core wars. During the 80s I was on the military side and the UBC net. I too remember when you noobz started getting onto our pristine military and research internet. Will in Seattle commented over 2 years ago | Report 0 0 Oh, fer fuck's sake, Willie. You're an idiot. You want to duel credentials? What a fucking moron. You'll lose there, too, though. Fuckhead. Cretin. More importantly: your immensely long and valuable computing history means nothing when you can't even make a simple statement without stepping in fourteen kinds of shit. Everything you've said in this thread is laughably false and nonsensical. If you've been computing since 1978, what the fuck were you doing there? Because you didn't learn ANYTHING. You know NOTHING about IPv6; you know NOTHING about messaging; you know NOTHING about email headers; you know NOTHING about Usenet; you know NOTHING about spam. By trumpeting your laughable credentials, you make yourself look STUPIDER, not smarter. Can't you see that? If you've been computing for 30 years and you still don't know anything about how email works, then what the fuck is wrong with you? We're not here to boast; we're here to answer questions. Your answer was not only wrong, but laughably wrong, written in a fakery of computer lingo; not only was it wrong, but it didn't make any sense. Thirty years for what, Will? It, like every answer you've ever given to any question in any forum, was designed not to enlighten but impress. That's pathetic. It's....I don't have words. You beggar belief. For the record, I was computing in the Dallas School District in 1973, and on the internet at Harvard in 1987. And I am currently among other things an email administrator. I'm not much of an expert, but I muddle through. And I don't go around trying to make people believe I know stuff I don't. Fnarf commented over 2 years ago | Report 0 0 Will - Seriously, you haven't a clue. Packets can't "verify" themselves any more than a teenager can "verify" his age at the liquor shop. Without some kind of independent source verifying the signature (a personal web of trust for PGP keys, Verisign and other certificate authorities for SSL keys), you could have all the encryption, authentication and verification you wanted but only a complete moron would believe it meant anything. And you, Will, are that complete moron. Lee commented over 2 years ago | Report 0 0 Not only that, Lee, but mail servers don't give a shit about IP authentication. The type of forgery Will is talking about almost literally never happens -- and is not used in spam, EVER. Mail servers ask you what domain name you're claiming to be, and then (sometimes) check that against the rDNS of the IP you've got (which is, as I said, never forged). If this is YOUR mail server, you can trust that conversation, and the reported IP. If it's further up the chain you can't -- NOT because of forged IP numbers in server negotiation, but rather because the entire conversation (the earlier Received: lines) can be made up. Just because Will's magic server authenticates as 1.2.3.4 doesn't prevent mail sending agents from saying "oh, yeah, sure, I got this from 1.2.3.4 upstream" for the same reason it doesn't prevent me from TYPING 1.2.3.4 right there. In short, Will is attempting to hijack a discussion on a topic he knows absolutely nothing about -- email sending -- to (a) drop a few nuggets he's picked up somewhere about another subject (IPv6), and incidentally to brag once again about how he invented the internet back at Shut the Fuck Up University. Which is to my mind tantamount to a hostile act directed at Questionland. And supremely lame. Fnarf commented over 2 years ago | Report 0 0 May I point out also that Will is now 0-and-14 on thumbs for this answer. Fnarf commented over 2 years ago | Report 0 0 And 26 and 71 lifetime. Presumably most of those 26 are him voting for himself. Fnarf commented over 2 years ago | Report 0 0 It's 0-and-18 now. Just as an afterthought: the "upgrade to a real OS" thing makes no sense either. Every operating system out there supports IPv6. Windows XP and Vista, presumably the OSes from which Will was suggesting that one ought to upgrade, most certainly do. On the other hand, the vast majority of ISPs do not assign IPv6 addresses, making the suggestion kind of difficult to follow regardless of the operating system in use. Hundreds of years from now, archaeologists will still be discovering new and distressing inconsistencies in Will's logic. Thankfully, we will not live long enough to see them all. Lee commented over 2 years ago | Report 0 0 You know, I was going to jump in and point out that the answer was nonsensical horseshit, but that's been done already, and better than I was going to do. ;-) Geni commented over 2 years ago | Report Enter your comment or ask a new question preview THIS IS A PREVIEW: Click "Post" to submit it or "Edit" to make changes. edit Please wait… This could take a minute if the tubes are clogged.

  Share this answer with a friend: