Being harassed on hotmail, how do I protect myself? How do I find out the IP?

[killertofu]

OK, there's this person (I know who, but I have to prove it), who is harassing me and all my friends/family by setting up a fake email account with my name, then guess-emailing all my friends/family in hopes that they will reply, to find out their email adresses. Once my unsuspecting friend/family has replied (thinking it's me they're replying to), he knows that's their email address, and he starts to harass them. :| I need to prove to a judge that this person is who he is, but that's where I need help.

How do I find out the IP address of this guy if I only have his hotmail address and a message from that hotmail address? Is there any way?

Thank You in advance to anybody who can help me out. It's greatly appreciated.

 

[Saltin]

It depends on the email client you are using. Are you using Outlook or Outlook express? I know how to do what you are asking if you are.

Basically, you need to open up a message you have recieved from him, and then pull up the properties (in outlook) or options>Detail tab ( in OUtlook Express).
You will see the headers at this point. It will look something like this.
Return-Path: <soansso@hotmail.com>
Received: from hotmail.com ([216.33.148.160]) by s13-srv.joeblow.net
(InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP
id <20020107035052.VZLK1750.s13-srv.joeblow.net@hotmail.com>
for <YOUREMAILADDY@HERE>; Sun, 6 Jan 2002 22:50:52 -0500
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Sun, 6 Jan 2002 19:50:51 -0800
X-Originating-IP: [24.102.74.11]
From: "Richie" <joeblow@hotmail.com>
To: "JW" <youremailadd@here>,

References: <000901c196f8$70aa4f70$0100000a@newpakchooie>
Subject: Re: New Advanced Technology: Nano Hat.
Date: Sun, 6 Jan 2002 22:47:21 -0500
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_000B_01C19704.19D09D10"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <OE64nccYTjr8cU6xfPT00006a57@hotmail.com>
X-OriginalArrivalTime: 07 Jan 2002 03:50:51.0859 (UTC) FILETIME=[8038F230:01C1972E]X-Originating-IP:

Ok, so see the part in bold? That's the IP the mail came from. At this point, you can run a whois on the IP and find out who owns the IP address block he's on. It will be an ISP of one kind or another, that's the ISP he uses. Call them and let them know the IP and the situation.

If he's clever he will have surfed to hotmail through and anonymous proxy, and you will be outta luck on the IP. He's doesnt sound clever though.

 

[killertofu]

Thank you for replying, but my friends/family don't use Outlook or Outlook Express to read their email. They use web-based hotmail. Would it be possible for my friend/family to forward me the email he/she recieved? Then I can look at it (in Outlook Express, because I use it) and see the original sender's IP?

 

[Hoober]

Your best bet might be to email hotmail directly. See if their service department can help you. Its a long shot, but it might be worth the effort.

 

[killertofu]

What's the customer service email for hotmail? support@hotmail.com or something like that? Anyway, it's a good idea, I'll try it.

Recently my firewall recorded a hack attempt by the IP 209.179.138.13. How do I run a whois on this IP?

 

[Hoober]

You can get the IP block and the owner from here

 

[killertofu]

Thanks. It said the ISP was Earthlink. Here are the gory details:

-------------------------------------------------------------------------

EarthLink Network, Inc. (NETBLK-EARTHLINK-RE-NET)
3100 New York Dr.
Pasadena, CA 91107
US

Netname: EARTHLINK-RE-NET
Netblock: 209.179.0.0 - 209.179.255.255
Maintainer: ERTH

Coordinator:
Earthlink Network, Domain Administrator (DAE4-ARIN) arinpoc@corp.earthlink.net
626-296-2400 (FAX) 626-296-5113 (FAX) 626-296-5113

Domain System inverse mapping provided by:

DNS1.EARTHLINK.NET 207.217.126.11
DNS2.EARTHLINK.NET 207.217.77.12
DNS3.EARTHLINK.NET 207.217.120.13

Record last updated on 22-Apr-1999.
Database last updated on 16-Jan-2002 02:38:24 EDT.

-------------------------------------------------------------------------

Any info in there I can use to prove it was him in a court? Or is this all I need?