Internet guys... what do these headers tell you?

[AB]

Would appear to be a scammer working close to home... would like some info on him if at all possible...

Return-Path: <[e-mail]>
Delivery-Date: Mon, 07 Dec 2009 13:14:56 +0100
Received-SPF: pass (mxbap4: domain of hotmail.co.uk designates 65.55.111.80 as permitted sender) client-ip=65.55.111.80; envelope-from=[e-mail]; helo=blu0-omc2-s5.blu0.hotmail.com;
Received: from blu0-omc2-s5.blu0.hotmail.com (blu0-omc2-s5.blu0.hotmail.com [65.55.111.80])
by mx.kundenserver.de (node=mxbap4) with ESMTP (Nemesis)
id 0MDOjl-1NIxFq2khh-00Gmmd for; Mon, 07 Dec 2009 13:14:56 +0100
Received: from BLU142-W24 ([65.55.111.73]) by blu0-omc2-s5.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 7 Dec 2009 04:14:55 -0800
Message-ID: <[e-mail]>
Return-Path: [e-mail]
Content-Type: multipart/alternative;
boundary="_189a5f5f-6926-4e03-8d32-6fce3637f71b_"
X-Originating-IP: [94.168.12.36]
From: scouser liverpool <[e-mail]>
To: <[e-mail]>
Subject: RE: Reply to your ad: VERTU ASCENT TI FERRARI UNLOCKED
Date: Mon, 7 Dec 2009 12:14:54 +0000
Importance: Normal
In-Reply-To: <005901ca7736$2192f960$64b8ec20$@co.uk>
References: <[e-mail]>
<[e-mail]>,<001d01ca7720$a5fe5d90$f1fb18b0$@co.uk>
<[e-mail]>,<005901ca7736$2192f960$64b8ec20$@co.uk>
MIME-Version: 1.0
X-OriginalArrivalTime: 07 Dec 2009 12:14:55.0362 (UTC) FILETIME=[E2FC8620:01CA7736]

[robbieduncan]

It tells me that a Virgin Media customer at cpc2-live20-2-0-cust35.know.cable.virginmedia.com seems to have sent an email that claims to be from Hotmail.

[Silent1]

Seems he's not too good at it though..

Actually, he could just be sending from hotmail through outlook, although the lack of sender info suggests not.

Edited by Silent1 on Monday 7th December 12:50

[AB]

Hmm, no other details such as location?

[CedGTV]

scouse_del_boy - Dodgy - Nah !

You'll be fine, whats the worst that can happen?

[Ikemi]

Host: cpc2-live20-2-0-cust35.know.cable.virginmedia.com
Location: GB, United Kingdom
City: Liverpool, H8 -
Organization: Telewest Broadband
ISP: Telewest Broadband
AS Number: AS5462 Telewest Broadband

[AB]

CedGTV said:

scouse_del_boy - Dodgy - Nah !

You'll be fine, whats the worst that can happen?

Haha, it wasn't so much the email address, of course I had no intention of dealing with him, he was just being an idiot.

But he took it a bit further so was keen to perhaps put the frighteners on in order for him to leave me alone?

[Herbie58]

And that he was selling stuff on ToolMart using the same alias, but had his goods/adverts deleted because they were illegal/against the rules in some way.

http://www.tootoomart.com/product-2661962-/

[Ikemi]

AB said:

Hmm, no other details such as location?

It's pretty difficult to find an exact location from an IP address unless the IP address is registered to the individual. In this case, the IP address has been assigned randomly by the ISP. You would have to call and ask his ISP, but I doubt they will give you his details!

[Arese]

cpc2-live20-2-0-cust35.know.cable.virginmedia.com

So he's a Virgin Media customer connected to Knowsley, at a guess.

[ukwill]

Ikemi said:

AB said:

Hmm, no other details such as location?

It's pretty difficult to find an exact location from an IP address unless the IP address is registered to the individual. In this case, the IP address has been assigned randomly by the ISP. You would have to call and ask his ISP, but I doubt they will give you his details!

It's not that hard. The ISP records all IP assignments/leases/durations. If they wanted to, they could pin it down to an address. You'd have to do more than just ask though.

[Ikemi]

ukwill said:

Ikemi said:

AB said:

Hmm, no other details such as location?

It's pretty difficult to find an exact location from an IP address unless the IP address is registered to the individual. In this case, the IP address has been assigned randomly by the ISP. You would have to call and ask his ISP, but I doubt they will give you his details!

It's not that hard. The ISP records all IP assignments/leases/durations. If they wanted to, they could pin it down to an address. You'd have to do more than just ask though.

Yeah, I meant to say it is difficult for joe public to find joe public via IP addresses

[AB]

"Cum ed ya nob ed, cum find me and wil chat bowt fake stuff n scams ey, put l11 4sy in ye sat nav"

Croxteth... figures.

[Silverbullet767]

AB said:

"Cum ed ya nob ed, cum find me and wil chat bowt fake stuff n scams ey, put l11 4sy in ye sat nav"

Croxteth... figures.

My, he sounds like a wonderful chap

Illiterate - check
Idiot - check
Aggressive - check

I think he looks like this.

[Jonny671]

Does this mean anything to you guys?

Microsoft Mail Internet Headers Version 2.0

Received: from blade204.lb.inty.net ([195.90.97.44]) by maz-srv01.Mazda.local with Microsoft SMTPSVC(6.0.3790.3959);

Tue, 15 Jun 2010 10:58:29 +0100

Received: from blade204.lb.inty.net (unknown [195.90.97.44])

by blade204.lb.inty.net (Postfix) with ESMTP id 4ECBA2C133

for <->; Tue, 15 Jun 2010 11:01:22 +0100 (BST)

Received: from blade204.lb.inty.net (unknown [127.0.0.1]) by blade204.lb.inty.net (Postfix) with ESMTP id 312BF2C136 for <->; Tue, 15 Jun 2010 11:01:18 +0100 (BST)

Received: from websrv01.infinityserve.co.uk (unknown [79.99.68.210]) by blade204.lb.inty.net (Postfix) with ESMTP for <->; Tue, 15 Jun 2010 11:01:17 +0100 (BST)

Received: from host217-37-49-237.in-addr.btopenworld.com [217.37.49.237] by websrv01.infinityserve.co.uk with SMTP; Tue, 15 Jun 2010 10:58:04 +0100

Would I be correct in assuming the email was sent from this IP..

79.99.68.210

I've removed abit of information from it, namely email addresses.. I see there are about 3 or 4 IP's but is the one I've bold'ed the sent from one?

[lestag]

Assuming blade204.lb.inty.net (unknown [195.90.97.44]) is your mail server, then yes it got it from websrv01.infinityserve.co.uk (unknown [79.99.68.210])

Jonny671 said:

Would I be correct in assuming the email was sent from this IP 79.99.68.210 ??

No it appears to of been relayed by that ip address. [217.37.49.237]

BUT

anything before 79.99.68.210

can be made up or hidden/stripped by
79.99.68.210

[Jonny671]

lestag said:

Assuming blade204.lb.inty.net (unknown [195.90.97.44]) is your mail server, then yes it got it from websrv01.infinityserve.co.uk (unknown [79.99.68.210])

Jonny671 said:

Would I be correct in assuming the email was sent from this IP 79.99.68.210 ??

No it appears to of been relayed by that ip address. [217.37.49.237]

BUT

anything before 79.99.68.210

can be made up or hidden/stripped by
79.99.68.210

Thanks very much.

So it appears it could be 79.99.68.210, but somehow routed through 217.37.49.237.

The former IP would make sense as its only 10 miles or so from where I am, and the latter IP is up, north of the M25 which wouldn't really make sence so I was assuming thats just the ISP IP?

ETA: If it was routed through 217, this being the actual email address IP, with 79 being where it was sent from, whilst from a Blackberry or the like?

I'm talking like I know what I'm on about but don't really

Edited by Jonny671 on Tuesday 15th June 12:39

[lestag]

Its simple really, just like the post office, it may go through may sorting centers to get to you.

In most cases when some one hits the send button it goes to their ISP's mail server then to your ISP's mail server and then to your PC

So reversing the order:

the email originated from host217-37-49-237.in-addr.btopenworld.com [217.37.49.237] to websrv01.infinityserve.co.uk

websrv01.infinityserve.co.uk sent it to blade204.lb.inty.net

blade204.lb.inty.net (unknown [127.0.0.1]) played with itself (127.0.0.0 is local to the machine )

And then sent it to your PC.

No idea if from a blackberry or PC . Im not familiar with BT's naming conventions

the mail servers could be anywhere in the world. If I sent an email to your email address it would go from here in NZ to the USA (where my mail server is hosted) to your ISPs mail server to you.

when you get a letter from royal mail, the only way you know where it came from is by the frank mark on the stamp and perhaps the senders address on the back. The frank mark you can trust , but the return address you can't. email headers are like that. bits you can trust and those you have to take at face value

[Jonny671]

Thankyou very much.

Makes more sense, I had hoped it would be the 79 IP as that would explain it all

[Taita]

Arese said:

cpc2-live20-2-0-cust35.know.cable.virginmedia.com

So he's a Virgin Media customer connected to Knowsley, at a guess.

The national headend for VM is at Knowsley so all Liverpool / NW zones terminate there. The regional headends tie in there too, ,and other bits and bobs such as Sky / BBC feeds come in.

The LIVE bit is the region locator, I can't remember exactly but I think there is about 9 of them for the country.