[Buffy]

I need to find out where two people are located, not their exact address, just a general idea of where they're located, from a couple of emails I have received. Can anyone help me figure this out?

Person #1:

Return-path: <xxxxxx@hotmail.com>
Envelope-to: xxxxx@xxxxxx.com
Delivery-date: Mon, 13 Feb 2006 14:34:12 -0500
Received: from [65.54.168.18] (helo=hotmail.com)
by server1.dnssecure.us with esmtp (Exim 4.52)
id 1F8jSd-0000z0-Uw
for xxxxxx@xxxxx.com; Mon, 13 Feb 2006 14:34:12 -0500
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Mon, 13 Feb 2006 11:34:06 -0800
Message-ID: <BAY113-F87FF577777927BEB55FA2D8070@phx.gbl>
Received: from 65.54.168.200 by by113fd.bay113.hotmail.msn.com with HTTP;
Mon, 13 Feb 2006 19:34:06 GMT
X-Originating-IP: [65.80.16.182]
X-Originating-Email: [xxxxxx@hotmail.com]
X-Sender: xxxxx@hotmail.com
In-Reply-To: <004201c62ecd$f0c6c690$13818a43@CHALLSTROM>
From: "xxxxxxxx" <xxxxx@hotmail.com>
To: xxxxx@xxxxxx.com
Bcc:
Subject: Re: hey
Date: Mon, 13 Feb 2006 11:34:06 -0800
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 13 Feb 2006 19:34:06.0635 (UTC) FILETIME=[7423EFB0:01C630D4]

Person #2:

X-Symantec-TimeoutProtection: 0
X-Symantec-TimeoutProtection: 1
Return-path: <xxxxxx@xxxxxx.net>
Envelope-to: xxxxxx@xxxxxx.com
Delivery-date: Fri, 10 Feb 2006 20:11:48 -0500
Received: from [206.46.252.42] (helo=vms042pub.verizon.net)
by server1.dnssecure.us with esmtp (Exim 4.52)
id 1F7jIb-00008S-KZ
for xxxxxx@xxxxxx.com; Fri, 10 Feb 2006 20:11:48 -0500
Received: from [10.0.1.4] ([71.107.57.253])
by vms042.mailsrvcs.net (Sun Java System Messaging Server 6.2-4.02 (built Sep
9 2005)) with ESMTPA id <0IUI009C80IW71I2@vms042.mailsrvcs.net> for
xxxxxx@xxxxxx.com; Fri, 10 Feb 2006 19:10:46 -0600 (CST)
Date: Fri, 10 Feb 2006 17:12:30 -0800
From: xxxxx <xxxxxx@xxxxxxx.net>
Subject: Re: Hey it\'s xxxxxx!
In-reply-to: <000e01c62cf1$0e0580e0$3783fea9@CHALLSTROM>
To: Amanda <xxxxxx@xxxxxx.com>
Message-id: <C01279FF.2DD1%xxxxxx@verizon.net>
MIME-version: 1.0
Content-type: multipart/mixed; boundary=B_3222436352_318182
User-Agent: Microsoft-Entourage/10.0.0.1309

[kiwiguy]

According to my view, the first one originated in Georgetown, the second may be somewhere in Virginia?

Not my field of expertise, but that is based on the IP addresses I think are the salient ones.

[Eriksrocks]

It is extremely hard to make an accurate guess, much less a true statement. If they used their ISP's email addresses, such as username@mn.rr.com, then it would be fairly easy to get a general idea, because the originating IP would be local (and the domain could also give something away, as in the example above).

If they used a different address though, such as username@gmail.com, it would be impossible to track them down because the IP would be Google's servers.

[hewee]

Person #1:
X-Originating-IP: [65.80.16.182]
Hollywood, Florida

Person #2:
Received: from [10.0.1.4] ([71.107.57.253])
Rainier, Oregon

I did these using the IP address and pasted the address in the "IP Address to locate" box.
http://www.geobytes.com/IpLocator.htm?GetLocation

But I am not good at reading the email headers so don't know how good this info is I posted.

[kiwiguy]

Interesting site hewee, and it gives quite a different result to samspade!

I think the IPs you used were the salient ones.

Wonder why there is such a difference between www.samspade.org and geobytes?

[hewee]

I like it to see what loop comcast moves me around on and right now I am in Sacramento 19 miles away. They switch between Citrus Heights and Sacramento al the time but then they stared a new one in Antelope I was on a long time.