Tracking Back an IP

Patricide

Ok i am in one bad mother of a mood cause someone has stolen my e mail and changed my password, and to top that there sendng e mails posing as me saying that i want to dump my girlfreind. My friend snagged the ip address off the e mail but is there anyone out there that can track it back to its source??? the ip is 193.120.103.65

testicle

You need to contact BT Ireland

% Information related to '193.120.103.0 - 193.120.103.255'

inetnum: 193.120.103.0 - 193.120.103.255
netname: CORP-DSL-ESAT-20040126
descr: Esat BT Corp ADSL Customer Block
country: IE
admin-c: ESAT1-RIPE
tech-c: ESAT1-RIPE
status: ASSIGNED PA
remarks: For SPAM/UCE complaints, please email "abuse@esat.net"
mnt-by: IEUNET-NOC
mnt-lower: IEUNET-NOC
mnt-routes: IEUNET-NOC
source: RIPE # Filtered

role: Esat.Net NOC
address: Unit 4029 National Digital Park, CityWest Business Campus,
address: Naas Road, Co. Dublin, Ireland.
phone: +353 1 2166300
fax-no: +353 1 6790832
e-mail: noc@esat.net
admin-c: CA1690
admin-c: CC1276-RIPE
admin-c: DR2498
tech-c: CB861-RIPE
tech-c: CO123-RIPE
tech-c: CD512-RIPE
tech-c: DH655-RIPE
tech-c: DV233-RIPE
tech-c: GC776-RIPE
tech-c: LH305-RIPE
tech-c: TK857-RIPE
tech-c: DB560-RIPE
tech-c: AH2714-RIPE
tech-c: RH2340-RIPE
nic-hdl: ESAT1-RIPE
remarks: Esat Net is the trading name for EUnet Ireland Ltd.
remarks: Also formally known as IEUnet Ireland.
mnt-by: IEUNET-NOC
source: RIPE # Filtered

% Information related to '193.120.0.0/16AS2110'

route: 193.120.0.0/16
descr: IEUNET-AGG-ROUTE-1
descr: Principal address block of EUnet Ireland
origin: AS2110
remarks: Aggregated route covering multiple EUnet Ireland networks
mnt-by: IEUNET-NOC
source: RIPE # Filtered

aidan_walsh

Patricide wrote:

Ok i am in one bad mother of a mood cause someone has stolen my e mail and changed my password, and to top that there sendng e mails posing as me saying that i want to dump my girlfreind. My friend snagged the ip address off the e mail but is there anyone out there that can track it back to its source??? the ip is 193.120.103.65

You can trace it back to a provider (EsatBT, it would appear), but other that that you're not going to be able to trace it to a house number...

Patricide

is there any way at all to somehow trace is back to a general location or anything?

Steoob

hey im the friend btw...would the ip being from esat mean that the person who sent it uses esat bt internet? not many people we know uses it so it would narrow it down alot...

**Timbuk2**

I used a traceroute software with the IP Adress that you gave and got the following, but I do not think that it is all that helpful

Traceroute Output

FROM getnet.net TO 193.120.103.65. traceroute: Warning: Multiple interfaces found; using 216.19.223.17 @ hme0
traceroute to 193.120.103.65 (193.120.103.65), 30 hops max, 40 byte packets
1 216.19.223.1 (216.19.223.1) 1.507 ms 0.801 ms 0.910 ms
2 phnx-core-7513.getnet.net (216.19.201.247) 1.050 ms 0.977 ms 0.912 ms
3 phnx-core2-7513.getnet.net (216.19.201.248) 2.319 ms 1.334 ms 1.238 ms
4 s1-0.ca01.phx01.atlas.cogentco.com (38.112.7.25) 2.002 ms 2.251 ms 1.901 ms
5 s4-5.core01.iah01.atlas.cogentco.com (154.54.1.145) 24.316 ms 24.364 ms 24.497 ms
6 p13-0.core01.ord01.atlas.cogentco.com (154.54.2.14) 51.900 ms 53.456 ms 50.852 ms
7 p14-0.core01.bos01.atlas.cogentco.com (66.28.4.109) 73.839 ms 70.705 ms 71.185 ms
8 p3-0.core01.lon02.atlas.cogentco.com (130.117.0.45) 140.622 ms 141.970 ms 142.187 ms
9 linx-gw.uk.esat.net (195.66.224.65) 143.524 ms 143.952 ms 144.409 ms
10 pos4-0.core001.cwt.esat.net (193.95.131.13) 155.724 ms 155.688 ms 155.829 ms
11 vlan3.rt002.cwt.esat-x.com (193.95.129.19) 271.008 ms 155.781 ms 153.525 ms
12 vlan53.rt501.cwt.esat.net (193.95.130.154) 155.592 ms 155.698 ms 156.087 ms
13 fe6-1.bas501.cwt.esat.net (193.95.136.48) 154.108 ms 156.573 ms 152.960 ms

I think you can also do this by going to the command prompt, and enter tracert <IP ADDRESS OR WEBSITE> and hitting return

Capt'n Midnight

tracert 193.120.103.65
...
9 22 ms 17 ms 15 ms pos2-3.core002.cwt.esat.net [193.95.131.5]
10 24 ms 17 ms 25 ms vlan2.rt001.cwt.esat-x.com [193.95.129.3]
11 113 ms 203 ms 236 ms vlan51.rt501.cwt.esat.net [193.95.130.138]
12 18 ms 24 ms 18 ms fe6-1.bas501.cwt.esat.net [193.95.136.48]
13 46 ms 33 ms 55 ms antech-adsl.adsl.esat.net [193.120.103.65]

Looks like it's ADSL rather than the more anonymous Dial Up.

I've no idea if antech-adsl is linked to a geographic location.

Maybe I'm cynical but unless it's a BT email address I'd doubt they'd do much..

Anyone know if our impersonation laws could cover this ?

Patricide

Are you sure its adsl? would you be able to say its a net cafe with minimal doubt cause if you can im pretty sure i know who it is.

aidan_walsh

Patricide wrote:

Are you sure its adsl? would you be able to say its a net cafe with minimal doubt cause if you can im pretty sure i know who it is.

Its possible, but its just as likely to be a home account from what we can tell you. BT would be able to tell you more, though they are under no obligation to.

testicle

email abuse@esat.net with your grievances

hobie

if it's 'dial-up' then a user gets a new IP addy every time he logs on ..... so it's important to know time and date that the addy was in use .... knowing this, ESAT should be able to trace it back to a source ......

now it depends on you convincing ESAT to investigate ..... I'm not sure how serious they take such enquiries unless a truly illegal activity is being carried out ....

Steoob

ya cant you do something and see what its registered under...you can with website addresses anyway...hmmm

leeroybrown

Capt'n Midnight wrote:

I've no idea if antech-adsl is linked to a geographic location.

Maybe I'm cynical but unless it's a BT email address I'd doubt they'd do much..

If it has a proper symbolic name as opposed to the usual dhcp style one it may well be a static ip belong to a business DSL package. Also if this is the case the symbolic name will quite often map (in some way) to the name of a company.

testicle wrote:

email abuse@esat.net with your grievances

If you continue to get this kind of e-mail contact their abuse address as suggested. They may not do much for a few e-mails but if it continues...

Patricide

Ok ive managed to get the person who stole it to give me the address cause i made ujp vaious bull****e about identity theft and jailtime and the like so thanks to everyone for the help but ive got it sorted now

riptide

Patricide wrote:

Ok ive managed to get the person who stole it to give me the address cause i made ujp vaious bull****e about identity theft and jailtime and the like so thanks to everyone for the help but ive got it sorted now

antech-adsl.adsl.esat.net

'Shuttle FTP Suite'. Brialliant stuff!

Edit: Patricide... you do know that in the 'Supreme Court of the Land of Riptide' email theft and general f'#kin about like that carries the death penalty!! Go very very hard on this person.

Capt'n Midnight

Just remembered.

In the US you can get 2 years for sending annoying emails or annoying internet posts if done annonymously. You could hand him over in Shannon, no need to worry about extradition warrants and all that junk the CIA will handle all that.

riptide

Capt'n Midnight wrote:

Just remembered.

In the US you can get 2 years for sending annoying emails or annoying internet posts if done annonymously. You could hand him over in Shannon, no need to worry about extradition warrants and all that junk the CIA will handle all that.

Ya just say his name is Abdullah and say he was found roaming around the tribal areas of "Corrán Tuathail". Just as good as Afghanistan... those Americans won't know the difference.... and he'll be in Guantanamo Bay before you can say 'Geneva Convention'.:D AHHHH ya can't beat the yanks!

hobie

In the US you can get 2 years for sending annoying emails or annoying internet posts if done annonymously. You could hand him over in Shannon, no need to worry about extradition warrants and all that junk the CIA will handle all that

..... and I'll send my fierce doggie over, to keep an eye on him while he is boarding !!!! .....