Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Tracking this 2 email

[hardjoko]

Can anyone tells me the IP address of these 2 emails. Also how can I know which one is their ISP? These people make an anonymous slanderous campaign that's simply factually incorrect.

Email 1:
Return-path: <johnjoint1@yahoo.co.uk>
Envelope-to: teguh@teguhbudimulia.com
Delivery-date: Tue, 08 Mar 2005 11:13:33 -0600
Received: from web26505.mail.ukl.yahoo.com ([217.146.176.42])
by may.nosdns.com with smtp (Exim 4.43)
id 1D8iGx-0005B6-CU
for teguh@teguhbudimulia.com; Tue, 08 Mar 2005 11:13:32 -0600
Received: (qmail 45111 invoked by uid 60001); 8 Mar 2005 17:13:30 -0000
Message-ID: <20050308171330.45109.qmail@web26505.mail.ukl.yahoo.com>
Received: from [202.156.2.58] by web26505.mail.ukl.yahoo.com via HTTP; Tue, 08 Mar 2005 17:13:30 GMT
Date: Tue, 8 Mar 2005 17:13:30 +0000 (GMT)
From: John Joint <johnjoint1@yahoo.co.uk>
Subject:
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-1513030081-1110302010=:42005"
Content-Transfer-Encoding: 8bit
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus


Email 2:
Received: from web32113.mail.mud.yahoo.com ([68.142.207.127])
by prserv.net (in1) with SMTP
id <2005050505114210103v8g9oe>; Thu, 5 May 2005 05:11:42 +0000
X-Originating-IP: [68.142.207.127]
Received: (qmail 36984 invoked by uid 60001); 5 May 2005 05:11:42 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
b=LvRZol6IsA0yNM3wEML6W1vT8Cu6wyfCtZ70DnwX2Aw27qDtas52KDUuxCRFXJhEiamLPQjDEv4NDa3UooAYrDCSJhPD+RDGUts0uFPyRq02tbHQm+RWlt1WMbCdFux57YtQTubln+7jOxomfyPt sAg17WXImtTpghqS/fGAN04= ;
Message-ID: <20050505051141.36982.qmail@web32113.mail.mud.yahoo.com>
Received: from [210.193.2.75] by web32113.mail.mud.yahoo.com via HTTP; Thu, 05 May 2005 06:11:41 BST
Date: Thu, 5 May 2005 06:11:41 +0100 (BST)
From: anthony yap80 <yap80_anthony@yahoo.com>
Subject: -- - REQUEST FOR REFUND
To: yap80_anothony@yahoo.com
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-1046950477-1115269901=:34715"
Content-Transfer-Encoding: 8bit

[hardjoko]

Correction, the second email might actually belong to someone trying to help us.

[cyberxhost]

Can you explain how the second email might be trying to help us?

[chris_jon]

I'm afraid there's no way we can find out about those emails other than the fact that they originated from Singapore.
See these IPs' WhoIs Report here...

http://www.dnsstuff.com/tools/whois.ch?ip=202.156.2.58
http://www.dnsstuff.com/tools/whois.ch?ip=210.193.2.75

However, its also possible that the email user has used a public proxy to cover his trails, so Singapore might be a false alarm.
Its just impossible to trace someone using just a single IP, keeping in mind the wide-spread use of public proxies & anonimizers.

[hardjoko]

What I mean is the email 2 belongs to a person trying to give header information of the culprit. However, he gives his own header information instead.

[hardjoko]

I'll tell more to you guys, but because this is still an investigation we can't blab alot till we nail the culprit. I doubt the culprit is smart enough to check wht though.

[cyberxhost]

why do they do that in the first place?

[hardjoko]

Envy. The root of all evil.

When somebody is succesful, someone somehow will say it's wrong. Then they'll come up with all the ******** to fight.