Identify this person and get lots of points?

Question

A person sent me a threatening message. Their e-mail they used was: [e-mail] the ip address was 125.215.159.132
Find out who they are. Email them and let them know you are researching who they are. Tell me if you find out and I will give you thumbs ups, stars, and points each day for 2 weeks.

Answer 1

ns11.imsbiz.com. (an authoritative nameserver for 159.215.125.in-addr.arpa., which is in charge of the reverse DNS for 125.215.159.132)
says that there are no PTR records for 125.215.159.132.

You can contact these folks because the message came through them:

inetnum: 125.215.128.0 - 125.215.191.255
netname: PCCW-BIA
descr: PCCW Business Internet Access
country: HK
admin-c: TA66-AP
tech-c: TA66-AP
mnt-by: MAINT-HK-PCCW-BIA
mnt-lower: MAINT-HK-PCCW-BIA-CS
status: ALLOCATED NON-PORTABLE
changed: [e-mail] 20051202
source: APNIC

role: TECHNICAL ADMINISTRATORS
address: Pacific Century Cyberworks
address: Room 280, 2/F Telecom House,
address: 3 Gloucester Road,
address: Wanchai, Hong Kong.
country: HK
e-mail: [e-mail]
admin-c: NOC18-AP
admin-c: JL1059-AP
admin-c: DL430-AP
tech-c: NOC18-AP
tech-c: JL1059-AP
tech-c: DL430-AP
nic-hdl: TA66-AP
notify: [e-mail]
mnt-by: MAINT-HK-PCCW-BIA
changed: [e-mail] 20020606
source: APNIC

Answer 2

I traced the IP address back to a company or person who is probably doing business via "imsbiz.com", a connection with this website:

http://www.biz.netvigator.com/eng/support/login/customer_login.html

Of course, that is based on the IP address you supplied. If you gave an incorrect address or if they spoofed it to make it look like it came from there, then we may be pointing at the wrong guilty party.

From the looks of things, this outfit is in Hong Kong, so don't think you will have much course of action. You could try contacting the ISP and seeing what they can do, if anything.


TraceRoute to 125.215.159.132

Hop (ms) (ms) (ms) IP Address Host name
1 0 0 0 66.98.244.1 gphou-66-98-244-1.ev1servers.net
2 0 0 0 66.98.241.16 gphou-66-98-241-16.ev1servers.net
3 0 0 0 66.98.240.12 gphou-66-98-240-12.ev1servers.net
4 1 1 1 129.250.11.129 ge-1-11.r03.hstntx01.us.bb.gin.ntt.net
5 1 1 1 129.250.2.228 xe-0-1-0.r20.hstntx01.us.bb.gin.ntt.net
6 7 7 7 129.250.4.70 p64-1-3-0.r20.dllstx09.us.bb.gin.ntt.net
7 7 7 6 129.250.2.185 p16-3-0-0.r01.dllstx09.us.bb.gin.ntt.net
8 7 14 7 206.223.118.48 ge3-0.cr02.dal01.pccwbtn.net
9 197 197 197 63.218.145.22 netvigator.ge9-2.br01.hkg05.pccwbtn.net
10 197 197 197 210.87.251.164 tmhsw11_r2.imsbiz.com
11 203 202 203 210.87.255.4 -
12 203 202 202 210.87.246.131 -
13 198 197 198 210.87.246.6 g0-1.imsbiz.com
14 206 205 206 125.215.159.132 -

Answer 3

You could forward the email to Hotmail's abuse department and if it keeps on happening and looks quite disturbing and serious, take legal action.

Answer 4

I tried and now they sent me a virus. Thanks a lot, bud!