I am communicating through email with a scammer who is trying to by me mw own parcel of land. I already contacted the police but it could take 2 to 3 months before they start investigating. I want to get the IP address of the scammer and provided it to the police. Is that possible? I tried to use different tools such as bananatag or mailtrack.io . They report me if the email was opened or not but not the IP address of the reader. I suppose such services use Pixel Images included in the email signature. If I create my own pixel and host it on my server will I be able to get the receiver info? Is there an easier way?

  • 1
    Even if you have their IP address, the police aren't really going to do anything about it. You have to prove a substantial loss in profit (think $10,000 and up) in order for them to consider it worth their time. A scammer is a dime a dozen. I think there was a talk at some security con where someone used OSINT tools to track down and locate a particular Nigerian scammer. Perhaps you should look into that.
    – forest
    Apr 1 '18 at 1:44

You can pixel all you want, but they might get a message in their mail client saying that "images" or "external content" has been blocked, and they'll have to manually allow it, which might be suspicious to them.

Something I used to do is forge a story inside the situation (add a bit of social engineering to the pixel idea). What I would do in this situation would be to send him an email:

I found a picture of a piece of land I'm willing to buy, please see below:
<img src="http://my.server.com/image.jpg?tag=827362923">

Then, you wait and later on search the web server logs with grep 827362923.

This has a few limitations:

  • Chances are the image gets picked up by antispam on the way, so you might get false positives that hit the link, you can check this with WHOIS (e.g. https://whois.domaintools.com/[enterIPHere])
  • The receiver still has to allow images to load in the mail client, but in this context, it's less suspicious than with a pixel.
  • It requires you to have your own server.
  • If the scammer is behind a VPN or proxy (which is very likely in most cases), you will obviously get that IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.