Trace a live.com user?

[Number6]

Good morning

 

Happy New Year to everyone.

 

Not sure where to ask this question so I put it here.

 

Our head is receiving really nasty emails from a user purporting to be a parent but the username is not a name that we know.

 

He / she is using a live.com address. Is there a way of tracing this user, or raising an issue with MS?

[localzuk]

I'm afraid the simple answer to both of those is 'no' - the Data Protection Act prevents MS from giving out any details. The only thing you can do, unless it is something illegal they have said/done (in which case it should go to the police), is reply and ask them to put it in the form of a letter, or to come in to the school.

[Number6]

I was afraid that might be the case.

 

The user is making statements that are probably libellous and defamatory. I don't think the police would be interested.

 

We've tried asking for details and tried to strike up a dialogue but to no avail. Trying to trace the user is a bit of a last resort.

[pagelad]

You could get the IP address the email was sent from out of the email headers and then compare it to other databases you have?

 

If you run an email server you could scan against all emails you've received on that and see if someone else has used an ip?

[Number6]

There's nothing on record to be able to easily search against to be honest. Thanks for the idea though.

[danIT]

Even if you managed to get an IP and match it to another IP, doesnt prove much.

 

Reply to the email once asking the parent to come forward, after that block it.

 

Try adding them as a friend on msn?

[pagelad]

Doesn't prove much but can give you a rough idea.

 

Might sound a bit daft but have you tried searching using the persons email address on facebook?

[AyatollahPies]

Reply to it with a nice dose of Netsky attached.

[Number6]

Even if you managed to get an IP and match it to another IP, doesnt prove much.

 

Reply to the email once asking the parent to come forward, after that block it.

 

Try adding them as a friend on msn?

 

Doesn't prove much but can give you a rough idea.

 

Might sound a bit daft but have you tried searching using the persons email address on facebook?

 

Nice ideas, thanks

[Number6]

Reply to it with a nice dose of Netsky attached.

 

I like it, but no, unfortunately

[zag]

I had this problem once and replied saying I had requested their IP address from Microsoft and would track their home address from that. They would then receive a letter in the post in a few weeks time. It was a complete lie but received an apology and promise of no more communication within hours.

[localzuk]

You could get the IP address the email was sent from out of the email headers and then compare it to other databases you have?

 

If you run an email server you could scan against all emails you've received on that and see if someone else has used an ip?

 

Wouldn't work - the headers contain the IP address of the sending client. In live.com's case, this will 99% of the time be the live.com servers - as it is web based.

 

Even if you get an IP address that isn't a live.com server, you can't use it to get anything, as they are somewhat dynamic on most home connections, and no ISP would hand it out without a court order.

 

Best advice is to reply saying that further communications will be ignored, and blocking that address.

[GrumbleDook]

If the contents are defamatory / libellous then take it to the police. They will be interested and it could even constitute harassment. It would require warrants to get the details from Live.com but they can be traced and served with notices. Speak with your LA legal team and if they don't have a policy then suggest that you are the guinea pigs for it.

[tom_newton]

Actually, webmail often does contain the IP of the original sender. This could be useful in so much as the mail may have been sent from within your school?

 

Hotmail for example puts in "X-originating-IP" - doesn't appear google do the same with gmail tho

[pete]

Assuming you have a VLE that keeps decent logs (moodle does) you could also compare originating IPs and see if you get lucky - it's not proof, but may give you more of an idea.

[buzzard]

As tom indicates, hotmail accounts do have the senders IP not the mail servers, I got caught out on an office wind up on it!! I was the only person living in Bolton with an NTL connection..

[Michael]

Personally I don't think there's a lot you can do, other than specify a rule to delete or send the e-mail to the spam folder. People soon get bored when they get no reply. I think replying will just encourage more unecessary e-mails.

 

I also highly recommend web forms, especially on school websites. I still see too many where the e-mail address itself is written on a page. It really isn't a good idea.

[solitaire89]

It should be possible to see the originating computer's IP address in the e-mail header. However, be aware, we've got a similar situation here of bullying e-mails sent using webbased mail, and it's being implied by parents that the originating IP was spoofed to frame another kid... considering this is 8 year old kids, I don't buy it for 1 second. BUT if your suspect is a parent and IT savvy, be prepared for a fight on your hands if you can match IPs

[danIT]

IP dont mean diddly squat, prove it, you canny.

[llawwehttam]

For this sort of thing I used to use bandook (if you have thir IP) not that I'm recommending it to anyone as It caused a lot of problems.

 

I think it was also referred to as PrinceAli and kinda came from RAT.

 

Personally in your situation I would just inform the police ( if the messages are threatening) or just send a response with a lot of fake code with the words 'hack' 'trojan' 'downloading' and 'virus' in it.

[neon]

could you set up a e-mail address yourself (nothing to do with the school @live?) and try and send emails that he / she will reply to? ask there name for free entry for an aston martin! then you'll get it! If not surely you can ban the incoming mail?

[JJonas]

We had something similar. I put the email address it had come from into our securus server to flag up any further occurrences. I caught one of our students composing the next email.