IP Addys from Yahoo Email?

[Morgan Ellis]

Anyone know how to check IPs on mail sent to a yahoo account?

We need to track someone who's sending threatening emails.

Thanks in advance,

Morgan

 

[Fred Zed]

Click on FUL HEADERS top right

In the example below the sender's IP is:
[172.25.23.252])

__________________________________
X-Apparently-To: fred_z_ca@yahoo.com via 216.136.226.142; 13 Nov 2002 08:43:28 -0800 (PST)
Return-Path: <xxxxxx@wdclnxmail1.learningtree.com>
Received: from 65.160.176.185 (EHLO wdclnxmail4.learningtree.com) (65.160.176.185) by mta130.mail.scd.yahoo.com with SMTP; 13 Nov 2002 08:43:28 -0800 (PST)
Received: from wdclnxmail1.learningtree.com (unknown [172.24.20.69]) by wdclnxmail4.learningtree.com (Postfix) with ESMTP id 71B793FF for <fred_z_ca@yahoo.com>; Wed, 13 Nov 2002 11:43:28 -0500 (EST)
Received: from SCHDMAST (ottntw106.canada.learningtree.local [172.25.23.252]) by wdclnxmail1.learningtree.com (Postfix) with SMTP id 2AAF96F91A for <fred_z_ca@yahoo.com>; Wed, 13 Nov 2002 11:43:28 -0500 (EST)
From: xxxxxxxxx@learningtree.com> Add to Address Book
To: fred_z_ca@yahoo.com
Subject: Master Today's Hottest IT Skills Plus Win an IT Course Anywhere in the World
Reply-to: xxxxxx@learningtree.com[/email]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Message-Id: <20021113164328.2AAF96F91A@wdclnxmail1.learningtree.com>
Date: Wed, 13 Nov 2002 11:43:28 -0500 (EST)
Content-Length: 1474

 

[Dave in Phoenix]

Anyone know how to check IPs on mail sent to a yahoo account?
We need to track someone who's sending threatening emails.
Morgan

Other than the info in the heading as Fred posted which may or may not be helpful, about all you can do is report to the police.

All the IP will tell you is what ISP the sender was using unless with a company that has their own server.

The police however can get from the ISP who was using that IP at a particular time, assuming its a rotating ip which is often the case. If its a static IP just for one customer its much easier but only the ISP can tell you and as far as I know will only provide the information by Court order or a police investigation.

 

[mtl_guy]

Its also easy to spoof the IP so it may be meaningless.

 

[zzap]

Its also easy to spoof the IP so it may be meaningless.

If the guys smart he will be using a mail forwarding service in another country that will hide his IP.
Or he might be tapping into a wireless "wi-fi" account of a next door neighbor. Lots of people are now buying wireless wi-fi routers for use at home. Most never change the password from "linksys" or turn of the encryption. The War Drivers Group reported 70% of the networks they found were wide open for anyone to access.

 

[DonAngelo]

...here is some info about IP addresses:

http://www.iana.org/

http://www.arin.net/

172.25.23.252 for instance would come up as:

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

NetRange: 172.16.0.0 - 172.31.255.255
CIDR: 172.16.0.0/12
NetName: IANA-BBLK-RESERVED
NetHandle: NET-172-16-0-0-1
Parent: NET-172-0-0-0-0
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: This block is reserved for special purposes.
Comment: Please see RFC 1918 for additional information.
Comment:
RegDate: 1994-03-15
Updated: 2002-09-12

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: Internet Corporation for Assigned Names and Number
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: abuse@iana.org

OrgTechHandle: IANA-IP-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-301-5820
OrgTechEmail: abuse@iana.org

# ARIN WHOIS database, last updated 2005-01-07 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.



...you can download a trial version of Visual Route, this could give you a little more info about the IP address. If it's coming from a proxy server like MegaProxy you might be out of luck.