Find IP: PC Tips by Anu

Showing posts with label Find IP. Show all posts

Tuesday, February 15, 2011

How to track the location of E-mail? + How to find the sender IP from E-Mail?

Tuesday, February 15, 2011

Anu

Here’s a quick how-to guide on how you can track email to it’s originating location by figuring out the email’s IP address and looking it up. I have found this to be quite useful on many occasions for verification purposes since I receive lots of emails daily due to my blog. Tracking the IP address of an email sender does require looking at some technical details, so be ready to dig your heels in!
There are basically two steps involved in the process of tracking an email: find the IP address in the email header section and then look up the location of the IP address.

Finding the IP address of an email sender in GMail, Yahoo Mail, and Outlook

Let’s go ahead and take a look at how you would do this for Google, Yahoo and Outlook since those are the most popular email clients.
Google’s Gmail
1. Log into your account and open the email in question.
2. Click on the down arrow that’s to the right of the Reply link. Choose Show Original from the list.

Now here’s the technical part that I was telling you about earlier! You need to look for the lines of text that start with “Received: from“. It might be easier to simply press Cntrl + F and perform a search for that phase. You’ll notice that there are several Received From’s in the message header. This is because the message header contains the IP addresses of all of servers involved in routing that email to you.

To find the first computer that originally sent the email, you’ll have to find the Received From that’s farthest DOWN. As you can see from the above image, the first one is from a computer called “aseem” with the IP address 72.204.154.191. Then it was routed to my ISP’s server at eastrmmtao104.cox.net and so on and so forth till it got to your email server.
The computer aseem is my personal home computer and that’s my public IP address for my house! I’ll go through Yahoo and Outlook before talking about tracking the location of that IP address.
Yahoo Mail Beta
1. Log into your account and open the email (if you’re using Yahoo Mail Beta with the new preview interface, make sure you double-click on the email so that it opens in a new tab)
2. At the top right, you’ll see there is a drop-down option where Standard Header is selected by default.
3. Click on it and choose Full Header.

Again, you’ll see the same information as before, just in a different window:

Microsoft Outlook
1. Open the email in Outlook by double-clicking on it
2. Go to View at the top menu (the menu options for the email, not the main Outlook window) and choose Options.

You’ll get a dialog box where you can set the message options and at the bottom you’ll see the Internet Headers box. For some silly reason, the box is very small and you have to scroll a lot, so it’s best to simply copy and paste the text into Notepad to view it more easily.

Tracking the location of an IP address

Now that we have our originating IP address of 72.204.154.191, let’s find out where that is! You can do this by perform a location lookup on the IP address. My favorites are IP2Location and GeoBytes IP Locator.
GeoBytes gave me a big map of New Orleans, LA along with a bunch of other information about the location itself.

IP2Location also gave me the same information pretty much, including the ISP (Cox Communications). Of course, this is correct since I live in New Orleans!
If you want more information, you can do a WHOIS database search also. My favorite one is the ARIN WHOIS Database Search. This will give you information on who hosts that IP address and their registration information. You can always contact them to try and find more information on that particular IP address.
Have fun tracking down those emails! Questions, comments, or suggestions? Post a comment!

Tuesday, November 16, 2010

How to find IP from an E-mail?(Gmail/Yahoo/Hotmail)

Tuesday, November 16, 2010

Anu

When you receive an email, you receive more than just the message. The email comes with headers that carry important information that can tell where the email was sent from and possibly who sent it. For that, you would need to find the IP address of the sender. The tutorial below can help you find the IP address of the sender. Note that this will not work if the sender uses anonymous proxy servers.

Finding IP address in Gmail

1. Log into your Gmail account with your username and password.
2. Open the mail.
3. To display the headers,
* Click on More options corresponding to that thread. You should get a bunch of links.
* Click on Show original
4. You should get headers like this:
Gmail headers : name

Look for Received: from followed by a few hostnames and an IP address between square brackets. In this case, it is

75.118.113.245
That is be the IP address of the sender!
5. Track the IP address of the sender

Finding IP address in Yahoo! Mail

1. Log into your Yahoo! mail with your username and password.
2. Click on Inbox or whichever folder you have stored your mail.
3. Open the mail.
4. If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on General Preferences
* Scroll down to Messages where you have the Headers option
* Make sure that Show all headers on incoming messages is selected
* Click on the Save button
* Go back to the mails and open that mail
5. You should see similar headers like this:
Yahoo! headers : name

Look for Received: from followed by the IP address between square brackets [ ]. Here, it is 202.65.138.109.
That is be the IP address of the sender!
6. Track the IP address of the sender

Finding IP address in Hotmail

1. Log into your Hotmail account with your username and password.
2. Click on the Mail tab on the top.
3. Open the mail.
4. If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on Mail Display Settings
* In Message Headers, make sure Advanced option is checked
* Click on Ok button
* Go back to the mails and open that mail
5. If you find a header with X-Originating-IP: followed by an IP address, that is the sender's IP address
Hotmail headers : name ,In this case the IP address of the sender is [68.34.60.59]. Jump to step 9.
6. If you find a header with Received: from followed by a Gmail proxy like this
Hotmail headers : name

Look for Received: from followed by IP address within square brackets[].
In this case, the IP address of the sender is [69.140.7.58]. Jump to step 9.
7. Or else if you have headers like this
Hotmail headers : name

Look for Received: from followed by IP address within square brackets[].

In this case, the IP address of the sender is [61.83.145.129] (Spam mail). Jump to step 9.
8. * If you have multiple Received: from headers, eliminate the ones that have proxy.anyknownserver.com.
9. Track the IP address of the sender

Thanks

Sunday, July 4, 2010

Backtracking EMAIL Messages

Sunday, July 04, 2010

Anu

http://www.principalspage.com/theblog/wp-content/uploads//2007/09/email-is-dead.jpg

Tracking email back to its source: Twisted Evil
cause i hate spammers... Evil or Very Mad

Ask most people how they determine who sent them an email message and the response is almost universally, "By the From line." Unfortunately this symptomatic of the current confusion among internet users as to where particular messages come from and who is spreading spam and viruses. The "From" header is little more than a courtesy to the person receiving the message. People spreading spam and viruses are rarely courteous. In short, if there is any question about where a particular email message came from the safe bet is to assume the "From" header is forged.

So how do you determine where a message actually came from? You have to understand how email messages are put together in order to backtrack an email message. SMTP is a text based protocol for transferring messages across the internet. A series of headers are placed in front of the data portion of the message. By examining the headers you can usually backtrack a message to the source network, sometimes the source host. A more detailed essay on reading email headers can be found .

If you are using Outlook or Outlook Express you can view the headers by right clicking on the message and selecting properties or options.

Below are listed the headers of an actual spam message I received. I've changed my email address and the name of my server for obvious reasons. I've also double spaced the headers to make them more readable.

Return-Path:

X-Original-To: anu@example.com

Delivered-To: anu@example.com

Received: from 12-218-172-108.client.mchsi.com (12-218-172-108.client.mchsi.com [12.218.172.108])
by mailhost.example.com (Postfix) with SMTP id 1F9B8511C7
for ; Sun, 16 Nov 2003 09:50:37 -0800 (PST)

Received: from (HELO 0udjou) [193.12.169.0] by 12-218-172-108.client.mchsi.com with ESMTP id <536806-74276>; Sun, 16 Nov 2003 19:42:31 +0200

Message-ID:

From: "Tiger"

Reply-To: "Tiger"

To: anu@example.com

Subject: STOP-PAYING For Your PAY-PER-VIEW, Movie Channels, Mature Channels...isha

Date: Sun, 16 Nov 2003 19:42:31 +0200

X-Mailer: Internet Mail Service (5.5.2650.21)

X-Priority: 3

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="MIMEStream=_0+211404_90873633350646_4032088448"

According to the From header this message is from Maricela Paulson at s359dyxxt@yahoo.com. I could just fire off a message to abuse@yahoo.com, but that would be waste of time. This message didn't come from yahoo's email service.

The header most likely to be useful in determining the actual source of an email message is the Received header. According to the top-most Received header this message was received from the host 12-218-172-108.client.mchsi.com with the ip address of 21.218.172.108 by my server mailhost.example.com. An important item to consider is at what point in the chain does the email system become untrusted? I consider anything beyond my own email server to be an unreliable source of information. Because this header was generated by my email server it is reasonable for me to accept it at face value.

The next Received header (which is chronologically the first) shows the remote email server accepting the message from the host 0udjou with the ip 193.12.169.0. Those of you who know anything about IP will realize that that is not a valid host IP address. In addition, any hostname that ends in client.mchsi.com is unlikely to be an authorized email server. This has every sign of being a cracked client system.

Here's is where we start digging. By default Windows is somewhat lacking in network diagnostic tools; however, you can use the tools at to do your own checking.

anu@nqh9k:[/home/davar] $whois 12.218.172.108

AT&T WorldNet Services ATT (NET-12-0-0-0-1)
12.0.0.0 - 12.255.255.255
Mediacom Communications Corp MEDIACOMCC-12-218-168-0-FLANDREAU-MN (NET-12-218-168-0-1)
12.218.168.0 - 12.218.175.255

# ARIN WHOIS database, last updated 2003-12-31 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

I can also verify the hostname of the remote server by using nslookup, although in this particular instance, my email server has already provided both the IP address and the hostname.

anu@nqh9k:[/home/davar] $nslookup 12.218.172.108

Server: localhost
Address: 127.0.0.1

Name: 12-218-172-108.client.mchsi.com
Address: 12.218.172.108

Ok, whois shows that Mediacom Communications owns that netblock and nslookup confirms the address to hostname mapping of the remote server,12-218-172-108.client.mchsi.com. If I preface a www in front of the domain name portion and plug that into my web browser, http://www.mchsi.com, I get Mediacom's web site.

There are few things more embarrassing to me than firing off an angry message to someone who is supposedly responsible for a problem, and being wrong. By double checking who owns the remote host's IP address using two different tools (whois and nslookup) I minimize the chance of making myself look like an idiot.

A quick glance at the web site and it appears they are an ISP. Now if I copy the entire message including the headers into a new email message and send it to abuse@mchsi.com with a short message explaining the situation, they may do something about it.

But what about Tiger? There really is no way to determine who sent a message, the best you can hope for is to find out what host sent it. Even in the case of a PGP signed messages there is no guarantee that one particular person actually pressed the send button. Obviously determining who the actual sender of an email message is much more involved than reading the From header. Hopefully this example may be of some use to other forum regulars.

Thursday, July 1, 2010

DOS : IP and port Info using Netstat

Thursday, July 01, 2010

Anu

http://www.computercourage.com/wp-content/uploads/2008/07/250px-ms-dos_logo.jpg

Hello friends, thanks for reading this text on learning more about using netstat to help you. Please disregard any spelling or punction or any other grammer errors. This text is written so the average reader can understand it. Not to complicated. Please enjoy and feel free to email me.

Use of Netstat

- (To OPEN Netstat) - To open [Netstat] you must do the following: Click on the
- [Start] button - Then click [Programs] - Then look for [Ms-Dos Prompt].

Netstat is a very helpful tool that has many uses. I personally use Netstat to get IP addresses from other users I'm talking with on ICQ or AIM. Also you can use Netstat go moniter your port activity for attackers sending syn requests (part of the TCP/IP 3 way handshake) or just to see what ports are listening/Established. Look at the example below for the average layout of a responce to typing Netstat at the C:\windows\ prompt.

C:\WINDOWS#netstat

Active Connections

Proto Local Address Foreign Address State

TCP pavilion:25872 WARLOCK:1045 ESTABLISHED

TCP pavilion:25872 sy-as-09-112.free.net.au:3925 ESTABLISHED

TCP pavilion:31580 WARLOCK:1046 ESTABLISHED

TCP pavilion:2980 205.188.2.9:5190 ESTABLISHED

TCP pavilion:3039 24.66.10.101.on.wave.home.com:1031 ESTABLISHED

Now look above at the example. You will see [Proto] on the top left. This just tells you if the protocal is TCP/UDP etc. Next to the right you will see [Local Address] this just tells you the local IP/Hostname:Port open. Then to the right once again you will see [Foreign Address] this will give you the persons IP/Hostname and port in the format of IP:Port with ":" in between the port and IP.

And at last you will see [State] Which simply states the STATE of the connection.

This can be Established if it is connected or waiting connect if its listening.

Now with this knowledge we will dive into deeper on how to use this for monitering and port activity and detecting open ports in use.

Detecting Open ports

Now so you are noticeing something funny is going on with your computer? Your cd-rom tray is going crazy...Opening and closing when your doing nothing. And you say What the phruck is going on..or you realize someones been messing with a trojan on your computer.

So now your goal is to locate what trojan it is so you can remove it right? Well your right.

So you goto your ms-dos prompt. Now there are many ways to use Netstat and below is a help menu. Look through it.

C:\WINDOWS#netstat/?

Displays protocol statistics and current TCP/IP network connections.
NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]
-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics.
By default, statistics are shown for TCP, UDP and IP; the -p option may be used to specify a subset of the default. interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.

I personally like using (C:\Windows\Netstat -an) Which Displays all connections and listening ports in the form of IP instead of Hostname. As you see how i did the command Netstat(space)-a(Displays all connections and listening ports.)n(in numerical form)
Netstat -an -So doing that does TWO of the options at once no need for -a-n. So now that you know how to use netstat to view all your connections and listening you can search for common ports like 12345(old Netbus Trojan),1243(subseven) etc. This Becomes very handy for everything you will soon find out. Take a break now and go chill out on your couch and relax for about 5 minutes and let all this soak in then come back ready to learn more. :)

SYN and ACK

When you here Syn and Ack(ACKnowledge) you do not think of the communication of packets on your system. Well let me tell you what SYN and ACK do.

[SYN] - SYN in common words is a request for a connection used in the 3-way handshake in TCP/IP. Once you send a SYN out for a connection, the target computer will reply with a SYN and ACK. So basically when you see in [State] catagory Syn that means you are sending out a request to connect to something.

[ACK] - Now the ACK is a ACKnowledgement to the request made by a computer that is trying to connect to you. Once a Syn is sent to you you need to ACK it, then Send back another syn to the computer requesting connection to confirm the packet sent was correct.

I sure hope that helped you understand a little more about SYN and ACK. If you have further questions try looking for texts on TCP/IP (such as BSRF's TCP/IP text - blacksun.box.sk/tcpip.txt). Now onto the fun stuff.

Using Netstat it for ICQ and AIM

Have you ever wanted to get someones IP address or hostname using [Aol Instant Messanger] or [ICQ]? Well your in Luck.

[AIM] - With AIM you can not ussually find the exact IP address without some trial and error because most of the time it seems to open up all online users on Port 5190. So Less users online easier it is. So goto Ms-Dos Prompt and type netstat -n here you will see under [Foreign Addresses] a IP:With port 5190. Now one of those IP's connected to you with 5190 is going to be your target aim user. Just use trial and error to find out is ussually the easiest way.

[ICQ] - To get a IP using netstat of a ICQ user is easy before talking to the person on ICQ you must open ms-dos prompt and do netstat -n to list all IP's and ports.Write them down or copy them somewhere you will remember to look back. Now it's time to find out his IP. Message the user witha single message now quickly do Nestat -n. And you will have a new added line of a IP address, just search for the new one on the list under foreign and once you find it you now have your buddys ip without any patches or hacks. Pure skill :P.

Other Uses

Netstat can be used to get IPs of anything and anyone, as long as there's a direct connection between you and the target (i.e. direct messages, file transfers or ICQ chats in ICQ, DCC (Direct Client Connection) chat and file transfers in IRC etc' etc').

Tools and Utilities:

Port scanning: To look for any open ports on a computer:

- [7th Sphere Port scanner] - (2 mirror sites so if one link doesnt work)

- http://members.xoom.com/Cryptog/7spereportscan.exe

- http://members.xoom.com/gohan_3/7spereportscan.exe

Firewall to moniter Ports and registry:
- [Lockdown 2000]

- http://www.lockdown.com

For Communicating better:
- [ICQ]

- http://www.icq.com

- [Aol Instant Messanger]

- http://www.aol.com

Two Quick Tips

A - Sometimes Netstat can generate very long lists, which are especially confusing for newbies. If you're having difficulties, just run netstat, and then make a direct connection of some sort to your target, or make it connect to you (ICQ, IRC etc', you get the picture) and run netstat again. There should be a new line - this is what you're looking for.
B - If netstat's output is too long, type 'netstat -an greather than c:\some-directory\some-file.txt' (without the quotes, and you can replace the parameters -an and the filename and it's path with anything you'd like). This will dump the output to that file for easy viewing, and will also let you copy AND paste.

I think there are better ways to understand the internet than with tools you find.

Learn how to do stuff manually so you fully understand whats going on. This will fuel your power and kill your lameness :)