Question IP Address links

[JennLL]

[Moderator edited to break up one solid paragraph of text.]

I am trying to ascertain whether you can determine if two different IP addresses belong to the same user if all but the last two digits match.

Basically this is an internet stalker situation and I've learned (at least one) of the possible perpetrator's IP addresses. I know he knows about computers, I know he uses VPNs/proxy's on occasion, and often hides behind fake accounts.

He offered up his IP at one point, as an argument against one of these anonymous accounts being him. On another occasion, I was able to capture an IP associated with hours worth of email account spam where the perp malicously subscribed me to all kinds of things from newspapers to Scientology newsletters and actually made appointments with various Scientology centers in my name.

So much so that i was getting multiple emails directly from Scientologists. Bottom line, they offered me the IP of the person who signed me up, and it turns out all of the subscriptions that night came from the same IP.

It is one digit off of the one offered by the person I believe is trolling me. Meaning the last two digits after the dot are different, but the first three are the same.

Comcast is the ISP for both the person I believe is my harasser, as well as the IP I captured.

When I do a simple internet search of the IP I captured, it says no proxy. So my question is, can I be reasonably sure it's the same person if all but the last two digits are the same?

Maybe what I need is someone to explain what each digit in the IP means. If it helps, this is the IP I captured: 73.61.8.235. Thanks in advance for anyone who can help.

 

[ex_bubblehead]

Using an IP address to identify a specific individual is not going to work. Unless IP addresses are static they can (and do) change. And, if proxies and VPNs are involved there's no way on Earth you can tie an address to a specific individual.

 

[JennLL]

I don't believe he was using the proxy at that time. A simple search shows there was no proxy being used when this occurred. It is also listed as a static address in the search. It is also listed as the area in which he lives. My question is related to the similarity in the numbers.

 

[ex_bubblehead]

You CANNOT use IP addresses to identify an individual unless you have direct access to the provider's database at the time the address was recorded.

 

[Ralston18]

If you have any idea about who the person is, and even if not - get legal guidance.

I am not a lawyer (full disclosure) but I suggest that you document everything you can, take screen shots, etc, then seek a free consultation.

The actions could be considered stalking , harassment, bullying. Actual terms would be up to the law and lawyers.

Many areas have such services.

 

[JennLL]

Yes, I am fully aware of that - and to do so I need a court order. That is not my question. Perhaps someone else can weigh in on what I asked. (Someone to explain what each digit in the IP means. )

 

[ex_bubblehead]

Yes, I am fully aware of that - and to do so I need a court order. That is not my question. Perhaps someone else can weigh in on what I asked. (Someone to explain what each digit in the IP means. )

This is as simple as it gets:
https://www.watchguard.com/wgrd-res...mentals/understanding-ip-addresses-and-binary

 

[JennLL]

Ralston, yes this has been fully documented and the IP turned over to police. It's a complicated case and as I'm sure most know, in order to get a court order for someone's IP, a legal action must be taken (or law enforcement must intervene) but I was trying to get information on what each part of the IP means, for my own edification. I suppose I gave too much backstory so that made the question seem as if I didn't understand that I personally would not be able link an IP directly to a person. What I hoped to get an explanation about was how the IP breaks down. As I understand it the first two digits relate to the ISP? Is that accurate? I'm not a computer person, so I'm doing my best to understand this using Google.

 

[bill001g]

You have no hope to really understand this searching google. In this case comcast actually owns 73.x.x.x but they also own or control many many more than that.

To really understand stuff like this you are going to have to really understand how the internet works between ISP. This is far from a beginner concept.

This is a list of the IP addresses comcast advertises to other ISP.

https://bgp.he.net/AS7922#_prefixes

This might not even be the complete list because comcast has acquired other ISP over the years and they may still be registered under other domains.

If he is even halfway smart he is using the neighbors wifi to get access. If it is his IP he will just claim that he did not have the wifi secured and someone else was using it. It tends to be impossible to actually prove who is doing the typing.

 

[JennLL]

Fortunately, there are multiple data points in this case with his prior bad acts and IPs secured in multiple other instances of his trolling. It will def be a matter of connecting the dots, which LE is hopefully doing at present. Only they will be able to get the info needed to secure information related to a specific user at a specific time, which is what is needed.

I only hoped to educate myself a bit in the meantime so I could understand the topic a bit more, myself.

 

[ProfSeaGoat]

You can't identify them unless they give personal details, at which point the IP given will be the nearest exchange that delivers internet from the persons ISP.
The nearest IP to the details is the most accurate.

 

[JennLL]

So to be a little bit more specific, this person would be trolling multiple people within the same online community, using the same MO and doing some of the same things to individuals. You'd be suprised how LE links online offenders like this (history of a decade of offending) - once you get LE interested, that is. Which usually involves a crime, or a long pattern of abuse and multiple victims. It only takes one screw up and the dominoes begin to fall, if you've got a good investigative team that have expertise in cyber offenses. If you haven't listened, I recommend season two of the Unraveled podcast. (The Stalkers Web) It covers a serial cyber offender and how they ended up catching him.

 

[ProfSeaGoat]

So to be a little bit more specific, this person would be trolling multiple people within the same online community, using the same MO and doing some of the same things to individuals. You'd be suprised how LE links online offenders like this (history of a decade of offending) - once you get LE interested, that is. Which usually involves a crime, or a long pattern of abuse and multiple victims. It only takes one screw up and the dominoes begin to fall, if you've got a good investigative team that have expertise in cyber offenses. If you haven't listened, I recommend season two of the Unraveled podcast. (The Stalkers Web) It covers a serial cyber offender and how they ended up catching him.

I may be a bit out of touch but since when is "trolling" A CRIME?

You are only a victim if you are too out of control of yourself or lack intelligence, not saying you do but there are crazy big limitations with the internet, it's not reality.

It's sort of on topic but going a different direction... but the severity of the matter.. matters here.

Text in plain form is easy to misinterpret also.

 

[USAFRet]

I am trying to ascertain whether you can determine if two different IP addresses belong to the same user if all but the last two digits match.

No.
You can't even know how many users are behind a single IP address.


As far as what the police can do vs what you can do...the police have far more resources behind them.
They can get a court order to get info from the ISP, whereas you cannot.

 

[JennLL]

I may be a bit out of touch but since when is "trolling" A CRIME?

You are only a victim if you are too out of control of yourself or lack intelligence, not saying you do but there are crazy big limitations with the internet, it's not reality.

It's sort of on topic but going a different direction... but the severity of the matter.. matters here.

Text in plain form is easy to misinterpret also.

Yikes. Trolling can be a crime in a lot of instances (SEE: the podcast I mentioned.) That started with harassing women online. Many women. It only takes a crime to get the investigation rolling. Then all of the trolling becomes part of the investigation and, in the end, part of the sentence, if there's prosecution.

Each state has laws on cyber harrassment/bullying/defamation, intimidation, etc.

It's pretty naieve to think "trolling" is a victimless crime.

"You are only a victim if you are too out of control of yourself or lack intelligence..."

Not even sure how to address that half-statment that doesn't explain how a victim of trolling lacks intelligence or is "too out of control" - kind of a blame-the-victim situation, imo. Or perhaps you just have issues with social interaction. I do have two adult sons with autism, so I'm aware many folks don't have the same skill set when it comes to online or personal interactions.

 

[USAFRet]

Yikes. Trolling can be a crime in a lot of instances (SEE: the podcast I mentioned.) That started with harassing women online. Many women. It only takes a crime to get the investigation rolling. Then all of the trolling becomes part of the investigation and, in the end, part of the sentence, if there's prosecution.

Each state has laws on cyber harrassment/bullying/defamation, intimidation, etc.

It's pretty naieve to think "trolling" is a victimless crime.

"You are only a victim if you are too out of control of yourself or lack intelligence..."

Not even sure how to address that half-statment that doesn't explain how a victim of trolling lacks intelligence or is "too out of control" - kind of a blame-the-victim situation, imo. Or perhaps you just have issues with social interaction. I do have two adult sons with autism, so I'm aware many folks don't have the same skill set when it comes to online or personal interactions.

Trolling is different than harassment.

 

[ProfSeaGoat]

Yikes. Trolling can be a crime in a lot of instances (SEE: the podcast I mentioned.) That started with harassing women online. Many women. It only takes a crime to get the investigation rolling. Then all of the trolling becomes part of the investigation and, in the end, part of the sentence, if there's prosecution.

Each state has laws on cyber harrassment/bullying/defamation, intimidation, etc.

It's pretty naieve to think "trolling" is a victimless crime.

"You are only a victim if you are too out of control of yourself or lack intelligence..."

Not even sure how to address that half-statment that doesn't explain how a victim of trolling lacks intelligence or is "too out of control" - kind of a blame-the-victim situation, imo. Or perhaps you just have issues with social interaction. I do have two adult sons with autism, so I'm aware many folks don't have the same skill set when it comes to online or personal interactions.

Lets say I am the one being trolled, I dunno, my manhood is too small or something.. what effect does that have on me? None as I am in control of myself and know myself..
The internet don't know me and neither does the supposed troll.

Harassment online if given the tools to circumvent it such as blocking.... is seriously minor.

There is such a thing as strong and weak minded people, this is a fact and I cannot say to you I am sorry, it's a part of reality.
Resilience.

 

[JennLL]

No.
You can't even know how many users are behind a single IP address.


As far as what the police can do vs what you can do...the police have far more resources behind them.
They can get a court order to get info from the ISP, whereas you cannot.

I think that's not actually true. Think of a situation where a person lives alone and is suspected of a crime or even internet activity that comes up in a criminal case.

That happens all the time. Browser history etc. comes up in trials.

Once LE gets a warrant to search devices, you've got IP info, then you've also got device info. Then you've got location tracking info, etc. There are many pieces to the puzzle when you're talking about a criminal investigation.

 

[JennLL]

Trolling is different than harassment.

Trolling can be harassment, absolutely.

 

[ex_bubblehead]

Alright folks, we're getting way off topic here. Let's get back to IP addresses and drop the other stuff.

 

[USAFRet]

I think that's not actually true. Think of a situation where a person lives alone and is suspected of a crime or even internet activity that comes up in a criminal case.

That happens all the time. Browser history etc. comes up in trials.

Once LE gets a warrant to search devices, you've got IP info, then you've also got device info. Then you've got location tracking info, etc. There are many pieces to the puzzle when you're talking about a criminal investigation.

And YOU cannot determine that.
You can maybe influence the police and ISP to divulge.

In any case...give whatever info you have to the police. Let them do the investigation, lest you corrupt the evidence.

 

[USAFRet]

To your original question.....

I am trying to ascertain whether you can determine if two different IP addresses belong to the same user if all but the last two digits match.

The ISP knows when those IP addresses were assigned, and where (mostly).

If xxx.xxx.xxx.x24 and xxx.xxx.xxx.x28 were assigned to the same house/residence/account at different times, that MAY lead to a contact of Who.

But it could not define if it was me on both, or me on Monday, and my grandson on Thursday.

 

[JennLL]

To your original question.....

The ISP knows when those IP addresses were assigned, and where (mostly).

If xxx.xxx.xxx.x24 and xxx.xxx.xxx.x28 were assigned to the same house/residence/account at different times, that MAY lead to a contact of Who.

But it could not define if it was me on both, or me on Monday, and my grandson on Thursday.

Does anyone know how long the ISP holds info like this? Like if you had an IP from years previous, let's say someone did a fake tip to a journalist on an investigation and LE were now trying to locate the person doing these fake tips (multiple) to see if they might actually be the perpetrator in the original crime the journalist was reporting on.

 

[USAFRet]

Does anyone know how long the ISP holds info like this? Like if you had an IP from years previous, let's say someone did a fake tip to a journalist on an investigation and LE were now trying to locate the person doing these fake tips (multiple) to see if they might actually be the perpetrator in the original crime the journalist was reporting on.

I doubt there is any standard retention length.

Any police investigation would start with the account holder.

 

[ex_bubblehead]

Does anyone know how long the ISP holds info like this? Like if you had an IP from years previous, let's say someone did a fake tip to a journalist on an investigation and LE were now trying to locate the person doing these fake tips (multiple) to see if they might actually be the perpetrator in the original crime the journalist was reporting on.

Years? No. Maybe a month at most. There's no real reason to archive this.