Tech Support > Computers & Technology > Computer Security > question about ip addresses
question about ip addresses
Posted by needahookup on July 10th, 2007


hi, does anyone know if its possible to obtain the ip address of a
person by their email address or their id in a chatroom or ng posts? i
had someone claim they got mine this way and i have heard of this
before....is it possible? thanks for your help

Posted by Bit Twister on July 10th, 2007


On Mon, 09 Jul 2007 23:05:57 -0000, needahookup wrote:
Yep, I see them in the header.

Do you mean like 67.187.64.8 c-67-187-64-8.hsd1.tn.comcast.net
Yep. it is in the header.

You bet. Since you are running Mozilla on XP Home,
click up a Command Prompt/terminal and do a
ipconfig /all
and see if 67.187.64.8 is your ip addy.


Posted by needahookup on July 10th, 2007


On Jul 9, 7:05 pm, needahookup <mike37...@gmail.com> wrote:
wow how do u find that out? can i find that out about others easily?
can it be hidden? what is mozilla? if im running it i am not aware of
it....do i need to run it or should i be? or not be? thanks


Posted by needahookup on July 10th, 2007


On Jul 9, 7:05 pm, needahookup <mike37...@gmail.com> wrote:
akso...this moron tried claiming i was posting from texas even tho i
live in tenn. does my ip say what state im from? is it wrong? or was
he just lying or stupid...thanks


Posted by needahookup on July 10th, 2007


On Jul 9, 7:05 pm, needahookup <mike37...@gmail.com> wrote:
and what do u mean "in the header" ? i dont see anything with those
numbers in it. what is the header?


Posted by Vanguard on July 10th, 2007


"needahookup" wrote in message
news:1184025293.700783.247520@r34g2000hsd.googlegr oups.com...

It depends on how much anyone bothers digging into your IP information.
Go look at:

http://www.dnsstuff.com/tools/ipall.ch?ip=67.187.64.8

That's some of the typical info about your IP address. You are posting
through Comcast. The registrant's info shows that IP address belongs to
Comcast and that *Comcast* listed their headquarters in Texas. However,
your IP name (from your IP address) is
c-67-187-64-8.hsd1.tn.comcast.net. The ".tn." means that you are
posting from a regional hub for Comcast that is located in Tenn.

Be careful who you're calling the moron. The "moron" was able to find
more than info that you could, and since you are more ignorant than this
so-called moron then what does that make you?


Posted by Leythos on July 10th, 2007


In article <1184022357.230601.163410@o61g2000hsh.googlegroups .com>,
mike37922@gmail.com says...
Depends on the program you use to communicate with.

EMail doesn't always show where you were connected, but it will show the
server you sent through.

Chat and IM can sometimes give you away depending on the IM/Chat
software.

Newsgroup - most post some form of tracking info, and IP that you posted
from is very common.

There is nothing to worry about as long as you practice proper security
and are not doing anything that is illegal or unethical.

--
Leythos - spam999free@rrohio.com (remove 999 to email me)

Learn more about PCBUTTS1 and his antics and ethic and his perversion
with Porn and Filth. Just take a look at some of the FILTH he's created
and put on his website: http://www.webservertalk.com/message1907860.html
3rd link shows what he's exposed to children (the link I've include does
not directly display his filth). You can find the same information by
googling for 'PCBUTTS1' and 'exposed to kids'.

Posted by needahookup on July 10th, 2007


On Jul 9, 7:05 pm, needahookup <mike37...@gmail.com> wrote:
first of all...i call him a moron because he decided for no reason to
spout off that i was not from tenn. my ip address showed him i was
from texas, as if i cared or even knew him, and as u have already
stated he wasnt even correct. those 2 things make him a dumb dickhead
in my book. he had to comment for no purpose on something he didnt
know the facts on....kinda like u did....


Posted by needahookup on July 10th, 2007


On Jul 9, 7:05 pm, needahookup <mike37...@gmail.com> wrote:
where does it show? i dont see anything like that on my screen, how do
u see it? can it be hidden? thanks


Posted by Ertugrul Soeylemez on July 10th, 2007


needahookup <mike37922@gmail.com> (07-07-09 23:05:57):

To understand this, it is advantageous to know how communication over
the internet works. You are using a program to communicate to someone
else, who also uses a program, maybe the same, maybe something similar
or at least compatible.

If you are communicating to some other user in the internet, then both
end-points are called peers. A peer always knows the IP address of the
other peer. Peer-to-peer connections are typical for all sorts of
instant messaging programs, where it would be unnecessary and too
expensive to route all the user traffic through some central entity.

Much more common, however, is the client/server-model. Again two
programs are connecting together, but this time, one of the programs is
a client program (the user), and one is the server program. This is
common for situations, where multiple users connect to a central point
(a service) to communicate to each other, or to just send and/or receive
some kind of information. This is common for web-browsing, emailing,
chatting in chat-rooms, and so on.

In the latter case, it really depends on how much information about you
the server sends along to other clients. In many cases, your client
does that as well. This is neither unreasonable, nor a security issue.
It's just a matter of how things are specified. For example, your email
server is supposed to attach host-name information to the message (this
includes your IP address).

To your second question, your IP address itself does contain a certain
amount of information about you. It contains information about your
provider, your country, and likely one can deduce some more accurate
location information from it. How much information is disclosed really
depends on your provider, but at least the provider itself and your
country will be known. Though for most providers that's about it.

More information can be found out by actually doing something with the
IP address. For example, tracing it will give information about where
the nearest router is from you (this can be as inaccurate as a country,
but also as accurate as a city). Scanning your host may even provide
information about your operating system or programs you are running.

Now don't panic. These informations are no security issues so far.
Just as well as other people can look at what clothes you're wearing,
other internet users can (likely) find out your operating system. And
as with clothing, there's little you could do about it. They will not
know your name or your home address, unless you tell them yourself.


Regards,
Ertugrul Söylemez.


--
Security is the one concept, which makes things in your life stay as
they are. Otto is a man, who is afraid of changes in his life; so
naturally he does not employ security.

Posted by needahookup on July 10th, 2007


On Jul 9, 7:05 pm, needahookup <mike37...@gmail.com> wrote:



thanks for that information....so how does another user on this group
go about seeing my ip address? by the way ur correct i have comcast
and somhow when u trace my ip it shows my city as well...im not
concerned about it at all just curious, but i dont know how to
actually get the ip number of another user, or how they see
mine...thanks again



Posted by Ertugrul Soeylemez on July 10th, 2007


needahookup <mike37922@gmail.com> (07-07-09 19:36:56):

Please reply to posts properly, i.e. click the "Reply to author" button
for the appropriate post, if you're using Google Groups.

Newsgroup messages are essentially emails, which are addressed to a
group instead of to another email address. In other words, they contain
the same information as email messages, and are syntactically
equivalent.


Regards,
Ertugrul Söylemez.


--
Security is the one concept, which makes things in your life stay as
they are. Otto is a man, who is afraid of changes in his life; so
naturally he does not employ security.

Posted by Vanguard on July 10th, 2007


"needahookup" <mike37922@gmail.com> wrote in message
news:1184029696.129735.95750@k79g2000hse.googlegro ups.com...

Are you corresponding with this person via e-mail? If so, and if they
got your e-mail address from here (which you show as
mike37922@gmail.com) then you have exposed your true e-mail address to
spambots that harvest e-mail addresses from newsgroups. Learn to munge.

If this "moron" is posting into the newsgroups, I certainly cannot see
any posts of anyone talking about Texas or Tennessee (other yours to
which I replied). I even went to Google Groups to look at the thread
(http://tinyurl.com/ytwjmj) in case whomever you were ticked off at
happened to be in my killfile which meant that I wouldn't see their
post. Nope, still don't see a post from this "moron". You are talking
to someone that no one else can see (well, that I can't see).



Posted by Vanguard on July 10th, 2007


"needahookup" <mike37922@gmail.com> wrote in message
news:1184029821.319281.206000@n2g2000hse.googlegro ups.com...

Since you are not replying to the author of whatever is their post, no
one know to whom you are responding. All your replies are going under
your starter post, not under to whomever you intended to reply.


Posted by Kwon on July 10th, 2007


On Mon, 09 Jul 2007 19:27:04 -0500, Vanguard wrote:

There's other ways too, that sometimes gives more accurate hits.

http://www.maxmind.com/app/geolitecity

Posted by Vanguard on July 10th, 2007


"Kwon" wrote in message newsan.2007.07.10.08.00.48@spamtrap.org...

I'm not using a lookup tool for IP address info that requires the
installation of a program, especially one that is bait for
commercialware (for prices see
http://www.maxmind.com/app/geoip_features). A big no thanks.

So when you enter 67.187.64.8 as the IP address to trace, what do YOU
get when using this locally installed tracer program? Somehow I can't
see any tracer program finding anything further than the boundary host
at a company or ISP since corporate networks are (or should be)
protected to prevent you from walking through their internal network.
When the tracer gets to 67.187.64.8, that is the boundary host at
Comcast in Texas, and you don't get to scan their internal network to
find that it then goes to their hub center in Tennessee. However, the
reverse DNS shows the IP name and Comcast, like some other ISPs, will
identify the region for the hub within the IP name, but anyone doing a
simple reverse DNS can see that, too.


Posted by Tim Jackson on July 10th, 2007


needahookup wrote:
From your point of view, as a poster via Google Groups, you click on
"More Options" and "Show Original". Those using a Usenet account and a
browser such as Thunderbird, it's View/Headers/All, or similar. The
same applies to email.

Those methods show you all the headers on the post or mail, most of
which are normally hidden.


Tim Jackson

Posted by Kwon on July 10th, 2007


On Tue, 10 Jul 2007 03:24:55 -0500, Vanguard wrote:

Well, the only thing I needed was the database and a script that could
read from it.

Carrollton. Which seems to not be accurate this time. Geolite is actually
free while the "big version" costs money, but the service still are
dependent on users sending correct data to them.

Sometimes, a regular traceroute works fine too...

13 te-6-1-ar01.sharpsridge.tn.knox.comcast.net <snip>
14 te-8-1-ur01.west.tn.knox.comcast.net <snip>

.... where "tn" may be "tenn"? But such traces may require a bit more
guessing. Not reliable, in other words.


Posted by Vanguard on July 10th, 2007


"Kwon" <kwon@nospam.nowhere> wrote in message
news:f6vil4$63n$1@stable.tornevall.net...
So it got to the same point as anyone looking up the registration for
the domain.

Oh, I see how it works. You download their database. You have to
repeatedly download their database to stay up to date but there is an
update function in their code (which you need to download). If you use
their script then you need to download the C library (i.e., code). I
didn't see anything particularly nasty but I only glanced over a couple
of the main C code files.

"We obtain the known IP location pairs from sites that ask the web
visitor to provide their geographic location." So they help collect
your personal info or collude with other sites to socially engineer you
into divulging that info. For example, when you register at a site, say
to join a forum, the questions include city, state, zip, etc. which then
eventually get distributed by that site to a 3rd party, like to MaxMind.
However, the IP address is often dynamic which means someone else will
eventually get it but the trick is that IP address ranges are often
delegated in a specific region by the ISP (i.e., their IP pool at their
regional hub always uses the same IP range for those customers).

So here we have a prime example of where you might think your personal
information is private and known only to the site at which you
registered and divulged your personal info (i.e., location) but instead
it gets passed onto 3rd parties that buy the personal info, like MaxMind
whose intent is to lure you to their paid services to access that info.
So be damn sure to read the TOS at a web site when registering there to
see what they do with the personal info you give them. They could be
selling it off to "affiliates", like MaxMind.

"By accurately pinpointing the location of Internet customers and
visitors by country, geographic region, down to the granular detail of
city in real-time, MaxMind enables online businesses to have a valuable
marketing tool as well as the ability to customize their websites to
better serve clients."

Online businesses with which I deal already have my personal info. If I
order from Newegg then obviously they have to know where to ship the
order. So these "online businesses" is a euphemism for spammers
(probably web sites) that want to target their pitch based on your
location.

So, yeah, they have a free service but realize how they got that info
and to whom they are reselling it. While the lookup doesn't reveal your
info, you could check if they managed to already get it through other
venues.

Traceroute not required. All it did was show the .tn in the IP name
which was already discernable from the nslookup.