The Non-Technical Guide To Finding An Email IP Address

James Bigglesworth (CyberCrimeOps.COM)
January 30, 2010

Being an anti-fraud activist for a number of years, and frequenting many different types of anti-fraud communities, I have heard many questions (and answers) about locating IP Addresses from an email. This article is for non-technical explanations into how to find it, and then how to figure out what it means.

MEET THE IP ADDRESS

Before we get started, let us look briefly at what an IP Address actually is.

Simply put, an IP (Internet Protocol) Address is a series of numbers assigned to a device that is part of a computer network. The IP Address can be thought of in the same light as a street address, giving a unique reference to a geographical location.

The IP Address is a set of 4 numbers separated by periods like this; nnn.nnn.nnn.nnn. Each number will be between 0 and 255 like this; 192.168.0.1.

When you connect to the internet, your ISP gives you an IP Address, and it stays with you as you surf the world-wide-web. You may get a different one from your ISP the next time you connect, or you may get the same one. When you send an email, each machine between you and the recipient makes their mark in the email header. These marks give a roadmap of how the email has travelled through the internet.

WHY IS AN IP ADDRESS IMPORTANT?

As mentioned above, an IP Address gives unique geographical pointers, and in the case of email communications can show you where an email actually came from, and the route travelled before it gets to your inbox.

This information can be vital in figuring out whether someone talking to you via email is being truthful about their location or not. For example; if someone you are about to purchase something from says they are in the UK, but their IP Address says Nigeria, then clearly you may be on the verge of being defrauded.

CAN EMAIL IP ADDRESSES BE MANIPULATED?

In short, yes. There are a few ways that an IP Address can be altered when sending an email. Spammers for example, use an Email Relay systems to obfuscate their originating location. So instead of an email really being sent from Russia, it may appear to come from the United States of America. Typically this kind of email is sent in bulk via specialised email software designed just for this task.

Other techniques are to send emails using scripts on a website, probably one that has been hacked into. These may only give the starting IP Address which relates to the machine on which the script was hosted.

Another technique is to use a webmail account that either does not give out the originating IP Address, or the webmail account is logged into whilst using a piggyback machine (Internet Proxy) to hide the real location.

HOW DO I FIND THE EMAIL IP ADDRESS

Locating the IP Address requires that you look at the header information embedded into the email itself. How you get to that information will depend on what you use to read your emails.

Rather than reinvent a wheel, I have chosen to incorporate information already published elsewhere. SpamCop.NET (anti-spam organisation) carry a large list of information regarding the revealing of email header information. The page is part of the SpamCop.NET FAQ [link] and covers many of the more popular software applications and webmail providers.

READING THE EMAIL HEADER

The email header contains a great deal of information, and for our purposes most of this is useless. Due to the possible wealth of information it is very easy (and common) for people to get completely confused.

First obstacle is realise that you must read the header from bottom to top and not top to bottom! This common mistake could mean the difference between identifying someone in Africa, or saying they are in Sunnyvale California and work for Yahoo!

As you read up the header, look for the first IP Address. You may be lucky as the header may have a special field called X-Originating-IP (or similar). If not, keep reading until you spot something, then look this number up using a WHOIS service (see below).

LOOKING UP AN EMAIL IP ADDRESS

As mentioned above, we need to use a WHOIS lookup service once we have located an IP Address. There are literally many hundreds of these on the internet that can be used.

I will recommend only two, as I use both of these myself. The first is called Domain Tools [link] and is my personal favourite. The other is called DNS Stuff [link]. DNS Stuff contains a lot more geeky tools, but look for the "WHOIS/IPWHOIS Lookup" and enter the IP Address.

The information you get back may give you the information your seek, such as the company & country that is allocated to that IP Address.

Some things to think about when getting results you don't understand. Some foreign countries, especially Africa, use satellite connections to get onto the internet. This means that the IP Address will relate to the first landfall that is made from the satellite. This could be in any number of countries, such as UK, Canada, USA, Israel, or others.

It takes more investigation at that point as you then have to visit the corporate website and try and find their coverage map, if they publish it. This will indicate what satellite services they utilise, and what areas of the world it covers.

IS THE ORIGINAL IP ADDRESS ALWAYS IN THE HEADER?

Unfortunately no. Some email services do not log the original IP Address in the header. Typically this would be done from a WebMail provider. Three of the best known IP hiders are GMail, FastMail and HushMail.

GMail and FastMail allow their users to send emails directly from their email application of their computer, instead of using the webmail interface. This mechanism does not hide the original IP Address, so it is always worth having a look at the header, just in case.

ITS TOO COMPLICATED, IS THERE AN EASIER WAY?

Fortunately there are people out there who like to help, by providing tools we can use for free. If you find reading an email header too confusing or complicated then try copying and pasting the whole header into the following web-page; http://headertool.apelord.com/. I have no idea who owns it, but it has been around for many years.

This very useful tool will read the header for you and display all those it finds, along with a probable country of origin. The email header will be displayed to you again, but all IP Addresses will be highlighted so you can see where they all are. This can be very useful if you are learning to read the header yourself.

The ApeLord tool will also have links to DNSStuff, to enable you to look at details in closer detail.

Further Reading

• Wikipedia - IP Address [link] | Private IP Address [link]
• Wikipedia - Email Relay [link]
• Wikipedia - Internet Proxy [link]
• SpamCop.NET - Reveal the full, unmodified email. [link]
• Wikipedia - Email Headers [link] | E-Mail Message Header [link]
• ApeLord - Header Analysis [link]
• WHOIS Lookup - Domain Tools [link] | DNS Stuff [link]

Original article written for Shawn Mosch, co-founder of ScamVictimsUnited.COM

This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License.

Cyber - Education/Awareness

From http://calendar.bollearningconnect.com/main.php?view=event&eventid=1260215055941
You offer internet banking because it is cost effective for the bank and convenient for the customer.

And when you complete a risk assessment, you review E-SIGN rules and logon credentials and disclosures you give your customers. But have you evaluated your customer awareness program? The FFIEC authentication guidance issued several years ago tells us "Financial institutions have made, and should continue to make, efforts to educate their customers. Because customer awareness is a key defense against fraud and identity theft, financial institutions should evaluate their consumer education efforts to determine if additional steps are necessary." It goes on to say that management should both implement a customer awareness program and evaluate its effectiveness periodically.

Banks are being sued by their customers when a loss is incurred via internet banking. While some banks look to Reg E for guidance, it isn't always there, and it won't apply when your customer isn't a consumer. Have you taught your customers how to act and react when there is a threat? In this webinar we will discuss:


What should be in your customer awareness program?

How to educate customers about phishing;

What you need to do when a phishing attack occurs;

Is mobile banking safer than using a PC?

Are customers required to practice safe surfing?

What is safe surfing?

Is multifactor authentication "required" for all customers?

What is a strong password, and how often should it be changed?

And much more.

About the speaker:

Andy Zavoina Mr. Andy Zavoina, CRCM, is a consultant with the Glia Group, best known for its involvement with BankersOnline.com.

Andy has been in finance and banking for 22 years. Over 20 years were with a holding company with two Central Texas community banks that had $534 million in assets, 89 branches spanning Texas and nearly 500 ATMs. After starting in loan workouts, Mr. Zavoina has been a consumer, commercial and real estate lender and managed those departments as well as being the banks first Webmaster. He was responsible for compliance- management, -auditing, and -training for both banks.

Andy is a past Chairman of the American Bankers Association's Compliance Executive Committee. He was the 2003 recipient of the American Bankers Association's Distinguished Service Award for his involvement and accomplishments in the field of regulatory
compliance management. He currently serves on the Editorial Advisory Board for the ABA's Compliance Magazine, Compliance Action magazine, is a member of the ABA's Compliance School Board and is a BankersOnline Guru. He also served on the
Texas Bankers Association's Compliance Committee.

He is a graduate of the ABA National Commercial Lending School, National Compliance and National Graduate Compliance School and is a Certified Regulatory Compliance Manager with the Institute of Certified Bankers. He has written numerous articles and
lectured on compliance, the use of the Internet and technology as a tool, as well as compliance in cyberspace to local, state and national associations. Internet policies and other compliance related programs are made available on his personal Web site.

Tax Preparer Scams

From http://www.doj.state.or.us/releases/2010/rel012510.shtml

Paying taxes can be painful, but falling victim to a fraudulent tax preparer is worse. Every year, scammers prey on unsuspecting Oregon taxpayers, stealing their refunds and leaving them with significant tax liabilities. The scammers also inflate expenses and claim false deductions and unallowable credits. As tax season approaches, Oregon Attorney General John Kroger is urging taxpayers to watch out for fraudulent tax preparers. Oregon taxpayers can protect themselves by verifying that their tax preparers are licensed with the Oregon Board of Tax Practitioners: www.oregon.gov/otpb. Never give out personal information such as your Social Security number, bank account or mortgage receipt to a tax preparer unless you have determined they are licensed.

Oregon is the only state that regulates tax professionals through competency and ethics standards. Anyone who prepares personal income tax returns for compensation in Oregon must be licensed by the Board of Tax Practitioners.

Last year, the Oregon Department of Justice and the Board of Tax Practitioners teamed up to stop an unlicensed tax preparer who violated the law 534 times.

Attorney General Kroger and the Oregon Board of Tax Practitioners offer the following tips when choosing an income-tax preparer:

Check to ensure the preparer is licensed at: http://www.oregon.gov/cgi-bin/tax.cgi
Be wary of tax preparers who claim they can obtain larger than normal refunds than others
Avoid preparers who base their fee on a percentage of your refund
Tax evasion is a federal felony, punishable by five years imprisonment and a $250,000 fine. If you or someone you know has fallen victim to a tax preparer scam, contact the Oregon Department of Justice Consumer Hotline at 1-877-877-9392 or the Oregon Board of Tax Practitioners at 503-378-4034.

'Helpless in Scotland' scam hits isle woman and friends - Hawaii News - Starbulletin.com

The story in the article 'Helpless in Scotland' scam hits isle woman and friends - Hawaii News - Starbulletin.com shows how easy it is to become a victim of a scam.


The woman featured in the story had gotten notification that her email account would be shut down if she did not updates some information.  It was through this email that scammers were able to get her email account information and then use her email account to send messages to a number of her friends saying that she needed to borrow some money and asking them to wire the money to her.


If you ever get a message asking you to update email account information, do not do so through any links provided within the email that was sent to you.  Open a new search window and go to your email account provider site on your own and contact their customer support . . . they would know if you really need to update any information.


Shawn Mosch
Co-Founder of ScamVictimsUnited.com
There is strength in numbers!

Find us on Twitter, Facebook and more through
http://www.retaggr.com/page/ShawnMosch

Support Scam Victims United by shopping at
http://shopittous.blogspot.com/

Identity Theft Protection

We recently had a family member who suspected that they could be a potential ID Theft victim. After some credit report checks and talking with a few experts, we believe that all is under control. I just want to take this time to suggest that everyone check their credit reports and learn more about ID Theft and how to protect yourself. One great way is through companies like LifeLock.




LifeLock

Scam mentioned on popular television

Does anyone watch the show Medium, about Allison DuBois who works for the DA's office and can see and hear people who have died and can pick up on things? Allison DuBois is a real person, and her gift has helped to solve many cases.

On the show this week her daughter Bridgette who also has this gift, runs into a man in the library using the computer every day. He is dressed as an African prince, or at least that is the way that he appears to the girl. She sees the name that he uses on an email account, and when her older sister is later complaining about the spam emails and mentions the same name Bridgette tells the family that she knows this guy and that he comes to the library all of the time. They family tried to tell Bridgette that it is a scam, and that he is just pretending to be a Prince with a lot of money and that in his emails he asks you to give him some money to help him get his money out of the bank that it is in.

(sorry . . . you have to watch the short ad in order to see the clip)



So, the next day Bridgette sees this guy at the library again and gives him all of the money she has (about $30 I think . . . remember, this is a girl in grade school) and she says he can take it to help him get his money and then he just has to pay her back when he does get her money.



The man later returns to the library to give Bridgette her money back saying that he cannot take money from a little girl, and that he had only been doing this type of thing for a few weeks. Don't we all wish that THIS part happened in real life!

I do think it is great that they are getting the word about the Nigerian scams out into the popular television shows. This one episode could have helped to educate a lot of people that this is a scam.

http://www.tv.com/medium/dear-dad-.../episode/1317709/summary.html?tag=ep_guide;summary

Counterfeit Check Scams

From the Internet Crime Complaint Center

The FBI continues to receive reports of counterfeit check scheme targeting U.S. law firms. As previously reported, scammers send e-mails to lawyers, claiming to be overseas and seeking legal representation to collect delinquent payments from third parties in the U.S. The law firm receives a retainer agreement, invoices reflecting the amount owed, and a check payable to the law firm. The firm is instructed to extract the retainer fee, including any other fees associated with the transaction, and wire the remaining funds to banks in Korea, China, Ireland, or Canada. By the time the check is determined to be counterfeit, the funds have already been wired overseas.

In a new twist, the fraudulent client seeking legal representation is an ex-wife "on assignment" in an Asian country, and she claims to be pursuing a collection of divorce settlement monies from her ex-husband in the U.S. The law firm agrees to represent the ex-wife, sends an e-mail to the ex-husband, and receives a "certified" check for the settlement via delivery service. The ex-wife instructs the firm to wire the funds, less the retainer fee, to an overseas bank account. When the scam is executed successfully, the law firm wires the money before discovering the check is counterfeit.

All Internet users need to be cautious when they receive unsolicited e-mails. Law firms are advised to conduct as much due diligence as possible before engaging in transactions with parties who are handling their business solely via e-mail, particularly those parties claiming to reside overseas.

Please view an additional public service announcement posted to the IC3 web site regarding a similar Asian extortion scheme located at the following link, http://www.ic3.gov/media/2009/090610.aspx. Individuals who receive information pertaining to counterfeit check schemes are encouraged to file a complaint at www.IC3.gov.