Member Avatar for littlesister

Sorry if wrong forum...

I am looking for how to find more information about a specific IP address:

My dumb husband has a mysterious email he doesn't think I know about. I saw it on his yahoo! mail acct under the "check other mail" box that they have for POP addresses. I'd mind my own business, but he asked for help quitting his habit of too much time on naughty sites. :eek: So now I am nosy.

The address he is checking from yahoo is (hisname)@

I looked up the IP address and got
Org.ID: IANA, and NameServer: BLACKHOLE-1.IANA.ORG & BLACKHOLE-2.IANA.ORG, and a message to see RFC 1918 for additional information. From a few googles I found that the IP address is similar to those other people say they have noticed trying to access their broadband connection all the time. Also found that this one of a range of "private" IP's, but may be related to "blackhole.isi.edu." Every now and then an Admin assumes a virus or a Trojaner is on their system.

I Found a site that says "In the RFC 1918 three IP nets for the use are reserved in private nets:
- (10/8)
- (172.16/12)
- (192.168/16). IP addresses from these nets may not be used in the InterNet."

***
I guess I just want any information you can give me. I tried just clicking the "check email for 192.... link in yahoo!, but 192... "terminated the connection". Maybe this is because it is old and now defunct? Or because it deflects reverse lookups? Is it possible to find out any more info abt the address?

Maybe it doesn't matter and I just have to assume that he has just created an email address at some alternate site that either just happens to be very cryptic and mysterious, or (more likely) is mysterious on purpose.

I wouldn't spy, but he's the one who asked for help and I am also sick of the stupid spyware we keep picking up (although that has decreased some by using appropriate anti-spyware). Also, I am a little concerned that this stupid address is not trustworthy and is a window for hackers through our anti-spy&virus software and firewall. Can I get reassurance that we are safe from that anyway?

  • 5 Contributors
  • 4 Replies
  • 242 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by slimeyapple

Dani AI

Generated

A few clarifications and practical steps that build on the replies from , and .

An address shown as hisname@192.168.1.2 in a mail listing is just a header field, not a public Internet host. Private LAN addresses (like 192.168.x.x) are not reachable from the Internet, so seeing that string can mean several things: a device on the home network actually generated the message, a local mail client or appliance inserted its own local name/IP into the From field, or the From field was forged by a remote sender. Yahoo failing to connect to 192.168.1.2 is expected because public mail servers cannot reach private LAN addresses.

How to narrow it down: view the full/raw message headers (often labelled "Show original", "View source" or "Full headers"). Save the headers and read the Received: lines from the bottom up — the bottom-most Received is the earliest hop and is the best place to find the originating IP. Also note any Authentication-Results, X-Originating-IP, Message-ID hostnames or DKIM/SPF results; those help reveal whether the From address was forged or legitimately submitted from inside the LAN.

Concrete next steps and cautions: check the Yahoo account for forwarding or fetch rules; review the router's DHCP/attached-devices list to see if 192.168.1.2 is an identifiable gadget (phone, NAS, printer, home server). Temporarily isolate the suspected device from the network, run up-to-date anti-malware scans, remove unfamiliar programs and check scheduled tasks/services. Rotate email and important account passwords and enable two-factor authentication. If unusual outbound mail or persistent signs of compromise remain, back up essential data and consider a clean OS reinstall — deep mail‑sending trojans can be very stubborn, as observed.

Reassurance: the presence of a private IP in a header is a clue, not a remote "open port" in itself. Combining header analysis with local device/router checks will reveal whether the issue is misconfiguration, spoofing, or malware.

Recommended Answers

All 4 Replies

Member Avatar for aamg37

192.168.X.X are internal IP address of any LAN (Local Area Network) - anyone can use this setting in their internal LAN - if you are getting emails from (hisname)@192.168.X.X that may be you local machine sending those email. You may have a virus that is creating this email. To check your IP address click start and click where it reads run - type cdm and a black windows will pop. Then type the command ipconfig and hit enter and you will see the local IP address of your machine.

Member Avatar for gaspar93

192.168.X.X are internal IP address of any LAN (Local Area Network) - anyone can use this setting in their internal LAN - if you are getting emails from (hisname)@192.168.X.X that may be you local machine sending those email. You may have a virus that is creating this email. To check your IP address click start and click where it reads run - type cdm and a black windows will pop. Then type the command ipconfig and hit enter and you will see the local IP address of your machine.

I used to have the same problem on one of my PCs. There was a trojan/worm that was sending a huge amount of emails out there. I didn't knew what to do because the antivirus I had, could detect the problem but cannot fix it. Even more, there was some strange ip address logs on my pc. On a simple netstat, I saw some IPs listening on weird ports like : 65155, or something like that. I checked those ip addresses on this ip lookup tool, and I discovered that some IPs were from countries I didn't have any conecctions with. Finally but sadly, the latest resort for me, was to erase the full HDD partition.
You might wanna check you conputer online. Check it with bitdefender or something.

Member Avatar for btaylor1

need help finding how to use my internet connection to psp

Member Avatar for slimeyapple

Some Freeware antivirus programs:

(AVG antivirus)

(Clam Win Antivirus)

both free. both have auto-update (definitions) and both will alert you to software updates when available.

alternately, you can purchase (and subscribe to for a fee) McAfee or Norton Antivirus :) the benefit to this would (I am assuming) phone based tech support.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.