2

I have an IP address of someone who has stolen from my company, but I'm pretty sure they relayed through another computer. The IP address I have doesn't go to home or business, but to a field in the middle of nowhere. How can I find the original IP address?

I don't think they would have spoofed their IP, because I've read it's fairly difficult, and this person is only stealing $100 at a time.

I've already reported it, but I had a similar situation months ago that I also reported, and nothing came of it (theft is too small I guess). Now, this person, or several people, are stealing every other day, in small amounts, from different IP addresses each time.

My business is small and I can't handle much fraud so I need to try to find this person ASAP.

My programmers are working on changing the backend to close the gap, but this person has already taken $2500. Thanks for any help you can give.

Improve this question
10
  • What are you going to do if you find the IP address? Chances are, you can't. It is so easy to cover your tracks when doing something like this. Better just get the backend fixed as soon as possible.
    – mikeazo
    Commented Jul 24, 2015 at 19:06
  • The IP address I have doesn't go to home or business, but to a field in the middle of nowhere. How did you come up with that explanation?
    – kasperd
    Commented Jul 24, 2015 at 20:04
  • 1
    You would have to have the cooperation of the person/company,/business/ISP running the relayed IP. Even then you would only get the next IP in the chain. Pretty soon you have spent 1000 of hours and need lawyers and etc. The local PBS TV station, a few years ago, had a special about someone who followed the chain all the way back to Ukraine, If I remember correctly, who earns like $100/month max. In the process he lost his wife, all his friends, and was 2 million USD in the hole. And PBS buying the story was all that saved him. Don't be this person.
    – cybernard
    Commented Jul 24, 2015 at 21:14
  • If your uncommonly lucky you can do a whois and get the network range and block the whole range. However, I suspect, you won't be that lucky that there limited to 1 range. I have 57402 banned ip and counting.
    – cybernard
    Commented Jul 24, 2015 at 21:25
  • 1
    Set an upper limit on time and resources you're willing to expend to catch this guy before you even start. And don't just spend the amount of resources they've taken to try to get those resources back; if you spend $2500 (or an equivalent amount of time) to track $2500, you've just lost $5000.
    – Parthian Shot
    Commented Jul 24, 2015 at 22:08

1 Answer 1

Reset to default
3

Short answer: Without either a trusted place on the internet (access to an Internet Exchange [IX]), ability to subpoena ISPs for logs/records, or some other intelligence (e.g. this IP also has posted to wikipedia with information that could lead to their identity), you don't.

When one uses a relay or a VPN to obfuscate their IP, there is no way the other end can tell what the originating IP is. All of that information is not included in the packets. The only way to actually trace it would be to get records from the ISP of the IP they are using, and determine what other connections were active to that IP. From there, one can begin to determine the originating IP address.

There is no such thing as "spoofing their IP" on the open internet when it comes to TCP sessions. When one spoofs their IP, they change the packet header to indicate the packet has come from a different IP than their own. However, this causes any return packets to go to the spoofed IP, and not the real IP. IN the case of TCP traffic, which includes http, SSH and most protocols the attacker is likely to use, a TCP handshake could never occur. This is because the spoofed IP will not respond to the TCP SYN (synchronize) statements, and thus no TCP socket will be created and no data can be sent.

In order to spoof an IP address on the open internet, one would have to use a BGP hack or do something of that sort -- prohibitively difficult attacks typically restricted to nation-state level cyber staff.

The question becomes: Why does the IP address matter? If there is a way for someone to steal, close that vulnerability and eliminate your exposure; so no matter where they come from they can't do anything malicious.

Improve this answer
6
  • I think you're making assumptions about how the IP address was obtained.
    – Neil Smithline
    Commented Jul 25, 2015 at 3:45
  • @NeilSmithline - how so? I'm addressing generalities on tracking IP addresses and don't see where I assume how one obtains the IP.
    – Herringbone Cat
    Commented Jul 25, 2015 at 14:50
  • You assume the IP was obtained in a way that would be hard to spoof. The question doesn't say enough for us to know that.
    – Neil Smithline
    Commented Jul 25, 2015 at 14:54
  • @NeilSmithline Ah yes. I do make it clear that only TCP sessions or packets requiring a return are hard to spoof -- others (TCP SYN floods requiring no reply, UDP, ICMP etc) can be spoofed one-way. However, can you think of a possible way that someone could steal money from a "spoofed" IP, from any web or internet accessible service, without being able to receive return packets?
    – Herringbone Cat
    Commented Jul 25, 2015 at 15:03
  • I can't figure out how they can be losing money and unable to stop it so I've concluded that I don't fully understand the situation.
    – Neil Smithline
    Commented Jul 25, 2015 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .