can anonymous web-based e-mail (e.g., sent from a hotmail account with
a non-identifying username) be traced to an individual sender,
individual machine, or geographic location?

---

Request for Question Clarification by politicalguru-ga on 21 May 2003 06:45 PDT

A short answer would be "yes and no" - some details you could get,
some others not. The reason I am stating that, is that the answer
might be different in cases of harrasment or other illicit activity
(spam, scams) than in other cases.

This may be different depending on the web-based email service used,
but on Hotmail, every email sent includes the header
"X-Originating-IP:".

While this doesn't show up by default in most recipient email
programs, it can generally be shown by viewing "all headers" (in
Outlook Express, this is done by clicking File: Properties on the
message, and then clicking the "Details" tab.)

Once you have the IP, you can usually find the ISP which controls the
IP by using a command such as "nslookup" from DOS or UNIX.  Simply go
to a UNIX or DOS prompt (to get to a DOS prompt from Windows, click
Start: Run and then type "cmd" and press ENTER) and then type
"nslookup 192.168.1.1", substituting the IP you found in the header
shown above.

At that point, you can trace the machine and ISP used.  To gather
actual user information, you'd have to send that IP to the ISP
involved, along with a court order, as ISPs generally won't divulge
user information without a clear legal claim.

Take care.

Search strategy: Personal experience

---

Request for Answer Clarification by kberner-ga on 21 May 2003 11:57 PDT

Ooops -- I accidentally gave you a lower rating than I intended -- do
you know how I can fix that?

It really just depends.

You didn't say if you were the person sending or receiving.

I'll assume you got some mail for my answer.

If the person sending is harassing you, you should be able to
determine the senders ISP (Internet Service Provider) as described
above (X-Originating-IP info).

Once you have the IP and you suspect the sender is from the Americas
you can go here and enter the IP (###.###.###.###) and get the main
domain owners info - then follow up with them directly (Contact info
should be listed in the results): http://ws.arin.net/cgi-bin/whois.pl

If you give then ISP a copy of the info (time sent and ISP) the
senders ISP can find out what account was using that IP at the time
the mail was sent via log files.  While they won't share that
information with you, they might contact the sender directly
themselves or even cancel their account if the person was harassing
you.

-Mike