A person was bugging my friend not necessarily threatening, but like sending useless messages for a long period of time on facebook. Is it possible to obtain the IP address of such person? (and then through IP locate the person?)

closed as off-topic by Teun Vink, Xander, Rory Alsop Dec 26 '18 at 22:18

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Rory Alsop
  • "This question does not appear to be about Information security within the scope defined in the help center." – Teun Vink, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Why not just block the person, or report them? – Philip Rowlands Dec 26 '18 at 18:16
  • 1
    Note that IP addresses are neither a confirmation of identity (despite the RIAA hoping otherwise), nor are they even a good indicator of location: For a while my IP address was being reported as 20 miles away from my real location. This is before taking into account any attempts to obscure the IP address (most of which are successful). – Clockwork-Muse Dec 26 '18 at 19:00

IP addresses are rarely a good way to identify someone: home IPs change often depending on the ISP, and the NAT'ed IP won't necessarily enable you to legally implicate someone within the network if there are multiple clients.

The best way to de-obfuscate someone is to convince them to give up their info willingly. Standing up a forum or website that you convince them to visit or register for is one method with the fewest legal pitfalls(provided you don't misrepresent yourself). This will also enable you to see the IP they connect from, but as noted, this is not sufficient by itself to determine the identity of someone.

To be sure you find the IP of the person you intended and not some random visitor, you can configure your site to redirect all requests to some default page (e.g. index.php), and hand them a link with some random junk appended:

hxxps://mysite.io/j4hhh5j3 -> 503 redirect to index.php

Then just locate that GET request within your apache access.log, and voila.

Keep in mind that this is just surface-level stuff; it takes 20 minutes to get a domain, get an ssl cert (zerossl.com is a good way), stand up a server on AWS, and set up a simple php website.

If this seems too complex, you probably shouldn't be trying it. Report and/or block them and move on.

Not the answer you're looking for? Browse other questions tagged or ask your own question.