Thread: Need Help (SOS)…Threat Mail with BSNL Broadband IP

One of my friend has applied for divorce, but his wife is opposing. The problem is, in the month of August’2009 some unknown person had send a mail to the boss of my friend’s wife about some obscene matter & adultery related thing with some person of the same office where she is working. This lady & her office friend filed a complain with CID cyber crime accusing my friend (the husband of the lady) directly. But we are sure that he did not send that obscene mail. But, CID personal is saying that one mail contain the IP address of my friend’s BSNL broadband connection. But how can it be possible where he was not the real culprit? How can CID said this?

Technically my friend has a BSNL broadband connection in his house. Has an ADSL modem provided by BSNL.

Need Help to solve the problem….

Well computers dont lie. If the ip address is of your friend then his connection was used for sending the e-mail... What could be debated is that your friend didint send the mail but some one else who had access to the connection did.

Adsl or cable or what ever connection it be... an ISP saves access data which can be used to reveal the identity of the person using a given ip address at a particular time.

Cyber crimes are pretty much black and white with nothing much to debate about as every single detail is supported with concrete evidence which is 100% reliable.

Friend only trying for divorce..... Why should his wife deny...?
After all, if he is innocent, why should he divorce?

In all probability, the friend seems to be the culprit in the email case....

@ghyboy

But we are sure that he did not send that obscene mail.

What could be debated is that your friend didint send the mail but some one else who had access to the connection did.

On above, the motive of X. ( a well wisher of the wife, say brother/uncle etc , who wanted the divorce should not be given, to blackmail the husband )


What is the email address used in the
mail in question ?
Say X used your friend's email ID and Internet connection ( on his own , or at the instigation of the husband ).
Husband cannot deny the mail originated from his BSNL connection. X could have connected another laptop to send the mail.
If The Senmail folder has been deleted , another charge destruction of evidence !
Or the Husband must prove he was not anywhere near the system within a radius of say 500 Km to have originated that message or
say on tour /hospitalized etc.


If the ID was that of Yahoomail Hotmail rediff com sify.com etc No hope.

Another way will be check the language used, of other emails, the husband alleged to have orginated.. .
Now if the lady's Office Boss had given the details of the email then & there to CID
the husband is prime suspect, to get the Divorce , by alleging Adultery etc.

He can surrender his hard disk for technical extraction of even deleted messages.
In my opinion, husband can
reasonably have the "benefit of doubt"
in this matter.
Check the Chronological order of the Divorce proceedings initiated, and show that there is no need for husband to have sent the alleged mail.
and if the Divorce petition is for some other reason/s.





PSlease note the opinion expressed above no way implies guilt on any one party , and is only a
way of looking at difficulty in proving the originator of an offensive email.
by the way the email still available in husband's
outbox ? ?

Dear essbebe,

Thank you for your advice.

The e-mail used for sending the mail was of gmail ID. It was send to the official ID of the lady's Office Boss. It was send from some unknown ID.

Why no hope? If the ID was that of Yahoomail Hotmail rediff com sify.com etc.

The lady's Office Boss had not given the details of the email then & there to CID. They filed the case after 1 week on Augut’09 itself with the print copy of mail (without the mail header) to CID, but the mail header had been given to CID after 6 months on March’2010 recent.

The husband surrendered his hard-disk to CID himself in Nov’09, but till date the forensic lab did not gave the report.

How the "benefit of doubt".

Is there any chance that the net connection had been Hacked..!!

Why no hope? If the ID was that of Yahoomail Hotmail rediff com sify.com etc

You can send an email from any computer anywhere in the world ( including internet cafes)
with @gmailID. yahoomailId etc.
Any one knowing the ID say EXAMPLE
husband @ gmail.com password abc1234
can log in normally and send any kind of message to anyone.
2. The message remain in Sent Box or trash Box.
Here trhe Header Message source has to pinpoint the mail originated from
ISP BSNL with ID husband @ gmail.com.

Now go to any other computer.
Log in with husband @ gmail.com PW
Check the sent box and trash box.
( Gmail keeps deleted mails for more time in trash box and most of us don't bother to clear it as Unlimited storage available in Gmail )


If you can take a print out of the header, and Message source, you need not wait for forensic
analysis.
Case 1 : Husband sent the mail from his system
Case 2: some one else X sent it from his system.
Case 3 : Another mutual friend trying to help or damage divorce proceedings sent the mail using husband @ gmail .com
Language used normally not usually used by
the husband. ( Take for sample 10 or twenty emails he had really sent to his wife , or inlaws earlier).
In any court case , a Charge has to be proved "Beyond Reasonable Doubt " , and if Husband can claim an "alibi" that the place where he was at that time ( origin of Message time ) had
no Internt Facility, he is free of this charge of sending this offending mail.
On same date if some other mail had been sent to others , check the headers also for comparison.
"Hacking" is not applicable here.
Para two ;
URGENT

BSNL Usage portal keeps usage data usually for Six months.
Check the day to day usage data for Nov 2009 and take a print out.
confirm husband, was not active at the time block mail was sent ! RUSH RUSH

An IP address is provided by the ISP. It cannot be duplicated. But here are some things to ponder upon:

1. If the mail was sent via gmail from the husband's BSNL connection, and assuming that port binding is in place, then it is not possible that someone can log in to BSNL connection from somewhere else. In this case, the husband will be hard pressed to explain.

2. Let us further assume that the husband did not send it. Then it means that his gmail account was open and known to someone else. Then someone logged in from his modem at his residence/place where connection exists. Husband will have to prove that his gmail account has been hacked and he was not at the place when the mail was sent. essbebe has clarified this.

3. essbebe has already mentioned several scenarios - so I shall not repeat here.

4. Since the wife is the injured party and filed the case, the onus will be on the husband to prove his innocense. Also note that the law will generally favour the wife.

You have not mentioned the ground for seeking divorce and I am not asking to break privacy here. The police can dig into the security archives and verify the claims. And I am assuming that they are doing this in a neutral manner. If they are indeed neutral and have the proofs, then your friend will have a lot of explanation to do.

Leave this to CID officers. They will decide the matter after all findings.
God help the poor boy.
-amen.

E-mails sent using gmail do not carry the senders ip address... The only party that can provide the ip details is Google and they wont disclose to authorities without a court order as far as I know... Has such an order been passed by some court for Google to disclose the ip address?

1. If the mail was sent via gmail from the husband's BSNL connection,
and assuming that port binding is in place, then it is not possible that someone can log in to BSNL connection from somewhere else. In this case, the husband will be hard pressed to explain.

I can use your GmailID and PW sitting here in Chennai on Airtel or BSNL or any other ISP BB or in a netcafe, and send an email.
with your ID. ( ID/password required!)

Question is : Will the Header show BSNL IP
( OF HUSBAND )
or any other IP address. ( of any ISP
for the offending email message .

Port binding etc does not arise.

Thread starter has assumed the mail was sent from husband's system with BSNL BB connection . by some one else.

Yes. I know that. I (or anyone) can use my gmail/Yahoo account from any computer.

The thing is that the mail headers will have a complete list of IP address from where the mail was sent. If the origin was from a BSNL IP address and BSNL shows that, that IP address was assigned to this account-id, that is where port binding comes into picture.

As shown in the example below, complete IP addresses can be traced:

Delivered-To: xxxxx@gmail.com
Received: by 10.114.134.10 with SMTP id h10cs92760wad;
Wed, 28 Apr 2010 19:07:16 -0700 (PDT)
Received-SPF: pass (google.com: domain of ______________ designates 10.223.5.69 as permitted sender) client-ip=10.223.5.69;
Authentication-Results: mr.google.com; spf=pass (google.com: domain of ______________ designates 10.223.5.69 as permitted sender) smtp.mail=______________
Received: from mr.google.com ([10.223.5.69])
by 10.223.5.69 with SMTP id 5mr10255200fau.37.1272506833561 (num_hops = 1);
Wed, 28 Apr 2010 19:07:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlegroups.com; s=beta;
h=domainkey-signature:received:x-beenthere:received:received:received
:received:received-spf:received:mime-version:received:received:date
:message-id:subject:from:to:x-original-authentication-results
:x-original-sender:reply-torecedence:mailing-list:list-id
:list-post:list-help:list-archive:sender:list-unsubscribe
:content-type;
bh=sdwh3ud0DbMZ1xoFK11QeGBcA3WVaSLIhq06nryiNOc=;
b=Wpzna3qZp9bZhs+nT4c16a08C0wE01AkWjdCsewwTlT+N1z+ 30lldas5RVvuQGIOfH
BhfXvMfANTc8YqZV1XKrUDimu3sxO7pjWSFsUap3hKqBaO+hoS gZZuDvghoBvJlvbjqd
ETvqHAO53y2sQeKqueYmMo2fBmo6aLEUIQVJc=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlegroups.com; s=beta;
h=x-beenthere:received-spf:mime-version:date:message-id:subject:from
:to:x-original-authentication-results:x-original-sender:reply-to
recedence:mailing-list:list-id:list-post:list-help:list-archive
:sender:list-unsubscribe:content-type;
b=lT08TQjjsTqWnf0FF8fKB6g6oaFgR7JN6Fm9JcnPYe7EaIB+ N8YdQSCUo09Pmj6xo1
E9nDZobOF+b8uMj+R2B0PH0zLVZWiIrJDgMBA7szZ86REvBL6c gZVKvgai0vqO9aT2Yu
7YqLik1pro+lfrvGp0xSRg4dTlvM40+jNse14=
Received: by 10.223.5.69 with SMTP id 5mr2462732fau.37.1272506829471;
Wed, 28 Apr 2010 19:07:09 -0700 (PDT)
X-BeenThere: ______________@googlegroups.com
Received: by 10.216.198.222 with SMTP id v72ls16798652wen.3.p; Wed, 28 Apr
2010 19:07:08 -0700 (PDT)
Received: by 10.216.183.12 with SMTP id p12mr818384wem.7.1272506827984;
Wed, 28 Apr 2010 19:07:07 -0700 (PDT)
Received: by 10.216.183.12 with SMTP id p12mr818383wem.7.1272506827581;
Wed, 28 Apr 2010 19:07:07 -0700 (PDT)
Return-Path: <______________@gmail.com>
Received: from mail-wy0-f182.google.com (mail-wy0-f182.google.com [74.125.82.182])
by gmr-mx.google.com with ESMTP id g1si453284wbg.6.2010.04.28.19.07.06;
Wed, 28 Apr 2010 19:07:06 -0700 (PDT)
Received-SPF: pass (google.com: domain of ______________@gmail.com designates 74.125.82.182 as permitted sender) client-ip=74.125.82.182;
Received: by wyf19 with SMTP id 19so225892wyf.27
for <______________@googlegroups.com>; Wed, 28 Apr 2010 19:07:06 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.216.88.148 with SMTP id a20mr6301663wef.124.1272506825561;
Wed, 28 Apr 2010 19:07:05 -0700 (PDT)
Received: by 10.216.7.146 with HTTP; Wed, 28 Apr 2010 19:07:04 -0700 (PDT)
Date: Wed, 28 Apr 2010 22:07:04 -0400
Message-ID: <p2vd244d2d01004281907g10d18a71xa991a884e3972fcf@m ail.gmail.com>
Subject: ______________
From: ______________ <______________@gmail.com>
To: ______________@googlegroups.com
X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com:
domain of ______________@gmail.com designates 74.125.82.182 as permitted
sender) smtp.mail=______________@gmail.com; dkim=pass (test mode)
header.i=@gmail.com
X-Original-Sender: ______________@gmail.com
Reply-To: ______________@googlegroups.com

great job j4k. I hope the author of this thread is satisfied now.

Gmail omits the orignating ip address from the e-mail header so it is impossible to find out the orignating ip address unless you approach google with a court order.. So did the wife's boss or wife or the CID manage to get a court order directing Google to disclose the orignating ip address?

Gmail only sends their mail server's ip address not the senders ip in e-mails sent using gmail.

PROBLEM
Thread starter has assumed the mail was sent from husband's system with BSNL BB connection . by some one else.


@just4Kix

From: <abcd1234@gmail.com> ( *ID edited )
To: "DE NIB CHN" <denibchn@dataone.in>
Cc: <jayshan88@bsnl.co.in>
References: <F932C508F8814ED6A906AD0C72A0CED2@samba> <012101cadc96$e7126cf0$0f01a8c0@bsnlff30ca963f>
Subject: Re: Redirection to "Motive" website MOST URGENT
Date: Fri, 16 Apr 2010 07:36:40 +0530
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0008_01CADD37.8DB09460"
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2900.5843
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.5579

Message follows ;

Questions :
(1)In which ISP's BB connection this message was sent ?
(2)What is the IP address ? of abcd1234 @ gmail.com
Did abcd1234 sent this message from his system?
How to prove it ?
PS: I used Outlook Express.
( not logged in to gmail)
message available in my OE sent folder.
will check in Gmail Folder later


@Parminder IP blanked . RED entry .
From Gmail Sent box ( same message )
UPDATE:.

Return-Path: <abcd1234@gmail.com> (*ID edited)
Received: from samba ([1XX.1X4.57.1X2]) ( *edited)
by mx.google.com with ESMTPS id y41sm2275526qce.17.2010.04.15.19.08.13
(version=SSLv3 cipher=RC4-MD5);
Thu, 15 Apr 2010 19:08:16 -0700 (PDT)
Message-ID: <7CA4C99F144246C78D9569CC0BE34C30@samba>
From: <abcd1234@gmail.com> (* id edited)
To: "DE NIB CHN" <denibchn@dataone.in>
Cc: <jayshan88@bsnl.co.in>
References: <F932C508F8814ED6A906AD0C72A0CED2@samba> <012101cadc96$e7126cf0$0f01a8c0@bsnlff30ca963f>
Subject: Re: Redirection to "Motive" website MOST URGENT
Date: Fri, 16 Apr 2010 07:36:40 +0530

if you can keep your computer on, u can access it anywhere from the world using your home internet connection. its called remote destop sharing, so by that ur using the resources of your computer and main thing the IP address and Mac id of the computer. thats y the email headder was able to fool the CID officials. SO crime branch only look for physical eveidence using logic but what about advanced networking. remote access & terminal server connetion. you can even restart the computer sitting anywhere in the world. but not physically.

Thats your answer: someone might have remote accessed the computer and used the Internet explorer to open Gmail and sent it from the computer.

@Niks
The email sent:
by whom ?
from where ?
How ?
FINALLY:
The email Header and Message source details
are the proper evidence.
@ghyboy
Feedback please.
( also on Broadband Usage details for NOV 2010
concerned date ) LAST day today to extract >

Thank you every one for your inputs. Also saying you that I am not that much expert about e-mail & computer. Want to help my friend any way…

For essbebe:
Taking a print out of the header is not possible. The Gmail ID used to send the mail was of some unknown person.

The lady's Office Boss received 2 mails one in the month of August'2009 & one in the month of September’2009 (was the time of mail send & received). It is almost 8 months now. BSNL Usage portal may not keep usage data for more than Six months. But what about the mail header? Does mail header carry any info of the PC from where the mail send?

For just4kix:
The ground for seeking divorce is the cruelty of the lady. What is port binding & how it works? Also what about the security archives that police can dig? Also true that police is not in neutral manner..!!

For Parminder:
If E-mails sent using Gmail does not carry the sender’s IP address or Gmail omits the originating IP address from the e-mail header …!! How can the CID said that one mail have the IP address of my friend?? Means CID is wrong. Kindly clarify…!!!

For Niks:
What is Mac id of the computer? Is this available in mail header?

Also it is doubtful about the internet & computer knowledge of both for the Judge in the court & the lawyer of the both side. So in that case the part of CID & there report is important. But than also technical debate will be there in the court.

For essbebe:
Taking a print out of the header is not possible. The Gmail ID used to send the mail was of some unknown person

If the mail with Gmail ID is not that of the husband ( for both emails ) and in his Inbox folder or trash folder the offending messages are not seen, there is no PROOF.

If this was sent in his machine, Google has to be approached for ID of "Unknown person"



The way you are asking questions,
I have my own doubts about this affair.

Is this a real story
or you are planning to make a movie.........with the theme husband, divorce and my friend!

Yes this is 100% true real story & a big banking group is involved in it. Will give u all the reality after the case is over in court....

@ essbebe: what about the time..that I mentioned..? Does mail header carry any info of the PC info?

What about port binding & Gmail does not carry the sender’s IP address?

@ just4kix, @Parminder, @Niks Plz reply…

An email is sent with googleID abcd@googlemail.com to xyz@ pqrst.com ( Office Boss)
Send from any where in the world from any system/cybercafe/laptop/ may be mobile phone etc.
2.
In this case SUSPECTED/ALLEGED to have been sent from Say System ONE. ( home PC/laptop)

0wner with Id husband@ gmail.com
denies sending the mail.

TRUE because the message will not appear in his SENT folder. in Gmail.


"abcd" mis-used the husband's system to send the mail .

All details about this message ( two) available only with xyz @ pqrst.com
( office Boss where wife works)
( header/message source/IP address etc )
Wife alleges Husband sent this . No proof.
Police claim: traced to husband's system by IP address.
( Not possible only the ISP's location shown )
( UNLESS husband has a STATIC IP address )
Then the TIME mail/s were sent
Another Grey area ! Only ISP ( say BSNL) can say
husband's computer was connected to their server at that time. which can be true/acceptable..

Para twoo you know the ID of "abcd" ?
Does this ID appear in the contact/friends list of Husband's
How he could access Husband's System?

Has the husband sent any message to him/her earlier ?

The charge/allegation that the husband, originated the offending emails is not acceptable, as no tangible proof available/possible..

TEST:
send an email to abcd@googlemail.com
say hello
click for read receipt.
Feedback.

Test here:
Get connected to Internet :
http://whatismyipaddress.com/
see your locartion with map.

If you are "confused' with all above , same for prosecution and Judge! charge dismissed!!!!
will not be part of Divorce proceedings to :
maY BE "fleece" MORE money from husband !

just bribe CID lolzzz

Ya man daya, abhijeet and ACP pradyuman never sleeps until the culprit is caught!

Can GMail be traced?

Leo, if you were to log on to a Google GMail account from somewhere other than your home computer (say work) and send an email from it... could it be traced to the computer you sent it from, or is it all traced back to Google? I have asked a few "experts", one says yes... one says no, that Google uses servers, and since its web based, that you can't trace it back to a specific computer.

In this case, I think that both could be right, and both could be wrong.

The issue boils down to: is the information kept? is it available? and what can you tell from it if you're able to get it?

When you send email using a "normal" email program, like Outlook, Outlook Express, Thunderbird, Eudora and the like, mail is sent using SMTP, or Simple Mail Transport Protocol. That's the same protocol that's used from server to server, as your mail makes its way from your machine, to your mail server, to the recipients's mail server to the recipient's machine.

Each step of that journey typically adds information to the mail header that documents which server (by name and IP address) received the message, from whom (again, by server name and IP address) and at what time.

So you can see that on the first leg of that journey, the internet IP address and machine name of the machine running your email program is typically one of the first things added to the information accompanying each message. That's usually your machine, and the IP address is either the address of that machine directly connected to the internet, or the internet IP address of any NAT router that you might be behind.

When you use an web-based mail program, such as GMail or MSN HotMail, you're not actually sending mail from your machine at all. You're using your browser to interact with a service that they provide on their servers. When you finally press send, the mail originates on the service's server, not your computer. If you take a look at the email headers for a message sent from a service such as GMail, you'll see only GMail servers and the servers required to deliver the message to its destination.

So, one would think that the information about what computer was used to access the web service in the first place is nowhere to be found. And, in fact, in my own test of GMail, that's what I found ... nothing. Nothing about the computer or IP address that I had used to compose and send the mail.

But...

There are two things you should be aware of.

I have seen HotMail add an "X-Originating-IP:" line to the headers of email. The "originating IP" is exactly that - the internet IP address of the computer used to compose the email. It's not always there, and I don't know what causes it to be placed there if it is. But if you're sending email from HotMail, you should know that it might be added to your outgoing email. I've not seen that from GMail, but it raises the second point...
"... you may not be able to trace where the email was sent from ... but law enforcement ... may be able to."

Web servers log who's accessed them and when, by IP address. Services such as HotMail and GMail are really just web servers, so you know that they do log access, for both reading and sending mail. How long do they keep their logs? No idea. Can they correlate their access logs with emails being sent? I would assume so. Do they make this information public? Not without a court order.

And therein lies the issue ... you may not be able to trace where the email was sent from with only the information in the mail - but law enforcement, with the help of the email providers, may be able to. If (and it's a big if), they believe it's worth their time to do so.

So the bottom line is simply this: if the information is not in the email headers, and it doesn't appear to be for GMail, you and I, as "mere mortals" cannot trace where email came from. However, the service providers can. But because of all the privacy issues involved, I would expect, and even hope, that they would only do so in response to legal action of some sort.

Originally Posted by ghyboy

For Parminder:
If E-mails sent using Gmail does not carry the sender’s IP address or Gmail omits the originating IP address from the e-mail header …!! How can the CID said that one mail have the IP address of my friend?? Means CID is wrong. Kindly clarify…!!!

Sending an e-mail using Gmail will not reveal your ip... I worked for a company in London and was living in Delhi for a complete one and a half year... never got caught.. I lied to them about being in London all that time..what else can I say! By the way I was not kicked out from that position. I left it because I couldn't keep up with the busy schedule and I am not that much of a hard worker and like to live a slower paced life as opposed to the demanding circumstances I was in those days. They still want me back even when I told the big boss that I was living in Delhi all that time we are good friends now and I provide them free consultation every now and then!

So no idea how CID could find out an ip address without the help of Google if mail was sent from a browser using gmail.