Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Identity Theft via email....

  1. #1
    Join Date
    Jan 1970
    Location
    Melbourne
    Posts
    1,006
    Total Downloaded
    0

    Identity Theft via email....

    Our daughter has had her Hotmail account hacked. The person has somehow gained access and has sent an email with a vicious message attached. The person has emailed everyone on my daughters mailing list which is the reason why I received it at work.

    The message is quite violent in its content and this has cause considerable angst amongst those who have received it.

    Obviously we are trying to assure people that my daughter would not have sent the email as she was at school at the time. I don't believe the school would give unsupervised access to computers.

    Is there any way to check which computer the email has originated from? Doesn't every computer have a number i.e. 123.456.789.0 and can it be traced?

    After finding out what was going on, our daughter has been bullied by this person for about the last two years. We are devastated.

    Its a sad world we live in if we have to deal with this crap

  2. #2
    p38arover's Avatar
    p38arover is offline Major part of the heart and soul of AULRO.com
    Administrator
    I'm here to help you!
    Gold Subscriber
    Join Date
    Jan 1970
    Location
    Western Sydney
    Posts
    30,714
    Total Downloaded
    1.63 MB
    What email program do you use, Lyndon?

    With Outlook, you can right click on the message (no need to open it), select Options, then look at internet headers. It will look something like this:

    Return-Path: <graymail@graysonline.com.au>
    Received: from graysonline.com.au (graysonline.com.au [202.58.37.241] (may be forged))
    by mail17.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id n0KLGL0X010869;
    Wed, 21 Jan 2009 08:16:21 +1100
    Received: from graysonline.com.au (localhost.localdomain [127.0.0.1])
    by graysonline.com.au (Throo.To(R)) with ESMTP id 202AF306366;
    Wed, 21 Jan 2009 08:16:21 +1100 (EST)
    Received: (from graymail@localhost)
    by graysonline.com.au (8.13.8/8.13.8/Submit) id n0KLGKLM030671;
    Wed, 21 Jan 2009 08:16:20 +1100
    Date: Wed, 21 Jan 2009 08:16:20 +1100
    Message-Id: <200901202116.n0KLGKLM030671@graysonline.com.au>
    To:
    From: "GrayMail" <graymail@graysonline.com.au>
    Content-Type: text/html
    Subject: Grill up a storm


    I don't know if that will help.
    Ron B.
    VK2OTC

    2003 L322 Range Rover Vogue 4.4 V8 Auto
    2007 Yamaha XJR1300
    Previous: 1983, 1986 RRC; 1995, 1996 P38A; 1995 Disco1; 1984 V8 County 110; Series IIA



    RIP Bucko - Riding on Forever

  3. #3
    p38arover's Avatar
    p38arover is offline Major part of the heart and soul of AULRO.com
    Administrator
    I'm here to help you!
    Gold Subscriber
    Join Date
    Jan 1970
    Location
    Western Sydney
    Posts
    30,714
    Total Downloaded
    1.63 MB
    Quote Originally Posted by feral View Post
    After finding out what was going on, our daughter has been bullied by this person for about the last two years. We are devastated.
    Bullying by girls is not uncommon. Our daughter was, too.

    A girl at her school was also bullied and, one day, knelt down on the pedestrian crossing in front of an approaching train where I work. The driver had no chance....

    Unfortunately, schools don't seem able to do anything about it.
    Ron B.
    VK2OTC

    2003 L322 Range Rover Vogue 4.4 V8 Auto
    2007 Yamaha XJR1300
    Previous: 1983, 1986 RRC; 1995, 1996 P38A; 1995 Disco1; 1984 V8 County 110; Series IIA



    RIP Bucko - Riding on Forever

  4. #4
    Join Date
    Sep 2007
    Location
    Gold Coast
    Posts
    6,078
    Total Downloaded
    0
    As Ron says that should give you the IP address of the machine that sent it. where you go from there though I am not sure.

    Do you or your daughter have access to an email sent from the bullier that you could compare the IP address from?

  5. #5
    Join Date
    Apr 2008
    Posts
    88
    Total Downloaded
    0
    Hi Lyndon,

    Firstly, sorry to hear what your daughter and your family are going through. This must be very dissapointing.

    You can to a certain degree, do what you're asking. If you have an original copy of the message you should be able to view the email headers. This will show the originating IP number of the sender.

    There is a problem though.

    Hotmail, as a web based service, will only show you which of their servers sent the message (giving you only part of the trail). What you need to do is report the account abuse to Microsoft. This can be done by going to the following link, and searching for the term 'abuse' in the search box:

    Windows Live ID and Account Management.

    I would also strongly recommend that your daughter changes her account password asap. Using the above link, search for 'password' to do that.

    In most cases, there is little chance of securing a prosecution for this sort of thing because of the complications of cross-boarder services, crimes etc. If you did want to go that way though, you would have to request access/session logs from Microsoft (who operate Hotmail/Windows Live) that would reveal the source IP of the user who sent the email. That information could then to cross referenced with ISP logs to identify the account holder who connected to their service and hacked your daughters account. This sort of information is typically only released under legal request.

    Good luck,

    Mark

  6. #6
    Join Date
    Jan 1970
    Location
    Wollongong
    Posts
    528
    Total Downloaded
    0
    First of all I would be changing your daughters pass word, then I would contact the school and make a report as more than likely the person doing this crap in some one from school. The school may not be able to do anything right now but they maybe able to in the future as this is probably not the first time this person has done this sort of thing. I would also be reporting this to the police because if this continues they have the best resources to track this person down. As Ron pointed out there is alot of kids that have taken there own lives over bullying and it needs to be stopped before it goes to far.

    Jeff

  7. #7
    JDNSW's Avatar
    JDNSW is online now RoverLord Silver Subscriber
    Join Date
    Jan 1970
    Location
    Central West NSW
    Posts
    29,538
    Total Downloaded
    0
    I sympathise (my grand daughters have had to change schools because of bullying, although not internet), but the problem with hotmail and similar accounts is that the trail will not go back to the computer, but only to the server as suggested, and legal problems arise to go further, as stated.

    However, as suggested, the culprit is almost certainly someone from the school and hence the incident should be reported to them - it may be the last straw to do something, as it is quite possible they may have a good idea who is responsible, even lacking any proof. Whether anything is done will depend on the school though.

    John
    John

    JDNSW
    1986 110 County 3.9 diesel
    1970 2a 109 2.25 petrol

  8. #8
    Join Date
    Apr 2002
    Location
    Godwin Beach 4511
    Posts
    20,694
    Total Downloaded
    32.38 MB
    depends how clued in the bully is.

    hotmail is dead easy to hack but it is more likely your daughter used a simple password that they have guessed.

    hotmail maybe able to find session logs if you can forward them the full headers of the original message etc to their abuse account.

    but, if our hero is clued in he will have used an anon proxy site which will leave no trail of any use, i doubt that would be the case tho...

    ditch hotmail, use another service.

    make sure you always use a password that isnt a dictionary word, and ensure it contains letters and numbers with at least one capitol letter.
    2007 Discovery 3 SE7 TDV6 2.7
    2012 SZ Territory TX 2.7 TDCi

    "Make the lie big, make it simple, keep saying it, and eventually they will believe it." -- a warning from Adolf Hitler
    "If you don't have a sense of humour, you probably don't have any sense at all!" -- a wise observation by someone else
    'If everyone colludes in believing that war is the norm, nobody will recognize the imperative of peace." -- Anne Deveson
    “What you leave behind is not what is engraved in stone monuments, but what is woven into the lives of others.” - Pericles
    "We can ignore reality, but we cannot ignore the consequences of ignoring reality.” – Ayn Rand
    "The happiness of your life depends upon the quality of your thoughts." Marcus Aurelius

  9. #9
    Join Date
    Apr 2008
    Location
    Adelaide SA
    Posts
    2,517
    Total Downloaded
    0
    All very good advice.

    I would report it as far & wide as you can to the appropriate people. This means the school, and police as a starting point.

    If there is a record of the incident with them, it will certainly make it easier in the future should the need arise to take matters further.

    Many a legal case has been won, (or lost) because someone was able to show that a particular event was not isolated, but was rather, a single event in a chain of many similar events.

    Lets hope things don't go that far, but it is best to be on the safe side.


    As far as the email goes, yep - change the password ASAP. But then use a different mail service, such as Yahoo or if using Vista, Windows Mail. If you have explained the circumstances of the original email to all of the recipients, then hopefully, they will be understanding and supportive of you & your daughter.

  10. #10
    Join Date
    Jan 1970
    Location
    Melbourne
    Posts
    1,006
    Total Downloaded
    0

    Thanks one and all....

    Thanks for all your support and thankyou for the good advice.

    I have taken control of all her accounts i.e. de-activated or changed passwords on all the 'Messenger/Facebook' type accounts. The passwords appear to have been fairly easy to crack. My daughter has most likely let it slip as well. I am supervising all accounts to see if there are any further issues. The passwords now used are only known to me.


    I have found the string......

    Received: from strontium.mailguard.com.au ([67.15.52.7]) by ntpdc. ith SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
    id 1ZBARAPA; Fri, 13 Feb 2009 13:34:43 +1100
    Received: from promethium.mailguard.com.au (promethium.mailguard.com.au [70.86.21.242])
    (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
    (No client certificate requested)
    by strontium.mailguard.com.au (Postfix) with ESMTP id 55B4016C2EF
    for Fri, 13 Feb 2009 13:34:42 +1100 (EST)
    Received: from promethium.mailguard.com.au (localhost [127.0.0.1])
    by promethium.mailguard.com.au (Postfix) with ESMTP id 553B741C251
    for >; Fri, 13 Feb 2009 13:34:41 +1100 (EST)
    Received-SPF: pass (promethium.mailguard.com.au: domain of hotmail.com designates 65.55.34.15 as permitted sender) client-ip=65.55.34.15; helo=col0-omc1-s5.col0.hotmail.com;
    Received: from col0-omc1-s5.col0.hotmail.com (col0-omc1-s5.col0.hotmail.com [65.55.34.15])
    by promethium.mailguard.com.au (Postfix) with ESMTP id 1BBD341C22D
    for < Fri, 13 Feb 2009 13:34:29 +1100 (EST)
    Received: from COL110-W29 ([65.55.34.7]) by col0-omc1-s5.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
    Thu, 12 Feb 2009 18:34:30 -0800
    Message-ID: <COL110-W2994B82D0CE68992A5A0AFF8B80@phx.gbl>
    Content-Type: multipart/alternative;
    boundary="_9e683a56-642c-474f-8479-a97964c0c892_"
    X-Originating-IP: [203.94.135.138]
    From:


    Sbject: FW:
    Date: Fri, 13 Feb 2009 13:04:29 +1030
    Importance: Normal
    MIME-Version: 1.0
    X-OriginalArrivalTime: 13 Feb 2009 02:34:30.0117 (UTC) FILETIME=[98D61950:01C98D83]
    X-SpamGuard-Score: 0.002
    X-MailGuard-ID: 4994dc361c4f3c
    X-Filtered: by MailGuard - visit MailGuard - Home
    --_9e683a56-642c-474f-8479-a97964c0c892_
    Content-Type: text/plain; charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable
    --_9e683a56-642c-474f-8479-a97964c0c892_
    Content-Type: text/html; charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable
    --_9e683a56-642c-474f-8479-a97964c0c892_--



    I have deleted all the addresses that I believe have nothing to do with the origination. From what I can work out I think the address is the 'X-Originating-IP: [203.94.135.138]


    Now if I match this to other emails received by our bully would you say that this is adequate evidence?

    Unfortunately this is one of my mates kids and we(my wife & I) would like not to lay blame but to rectify the situation and make sure they are aware of what is going on.

    I am unable to get my head around all this false world facebook stuff. We gave our daughter a little space to see if she could cope with the pressures of life as her life is now appoaching the teen years. She is a very intelligent girl, high distinctions in Maths, English for a number of years. She has so much potential but also so impressionable & vulnerable.

    I am concerned.

Page 1 of 2 12 LastLast

Bookmarks

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Search AULRO.com ONLY!
Search All the Web!