Is this a dodgy email header?

[RogerS]

This is the first entry in the raw source of an email I've been sent regarding renting some accomodation.

Received: from 46.37.178.108 by justmail.easily.co.uk with HTTP;
Thu, 26 Apr 2012 16:04:03 +0100
Message-ID: <[email protected]>
Date: Thu, 26 Apr 2012 16:04:03 +0100

I looked up 46.37.178.108 but got an invalid IP address. I don't know enough about this to know whether or not this address is valid (an internal IP address maybe) or a scam.

TIA

 

[devonwoody]

Perhaps its the same crowd that the TV blokes on the motorbikes investigated the other week. They were letting the same property with deposits to many people to the same address.

 

[CHJ]

http://www.ip-adress.com/map/Map_of_Uni ... 5b2f875ff3

 

[RogerS]

Thanks Chas

 

[JakeS]

I looked up 46.37.178.108 but got an invalid IP address.

How did you look it up?

There's nothing implicitly dodgy about the header snippet, it's just saying that the mailserver at justmail.easily.co.uk received the message from that IP address... meaning that IP connected out to the justmail.easily.co.uk server and delivered it there. I guess that easily.co.uk are the people who host the domain that you received the mail on?

Lots of sites will use an outgoing mail server which isn't otherwise connectable to from the outside world; it's a standard practice to disable all communications between the internet and your servers which aren't absolutely essential - for security reasons! That often includes pings and other "is this IP there" checks.

A whois at RIPE suggests that the IP in question is one allocated to Burst.Net; this is a datacentre/hosting company, so it was probably sent by one of their customers, from their hosted server. Whether the email is genuine or not probably depends more on who it purported to come from than anything else! If you're particularly interested you might try contacting Burst.Net to see if they'll tell you who rents the IP you got the mail from, but while I doubt they want scammers using their link, don't be surprised if they're more interested in protecting their customers' privacy than answering your question.

If you have a domain name from the email address you might try looking up who hosts that name and whether it resolves to the same block of IPs, but even if that doesn't match there's no guarantee that it's not legitimate; people can and do put return addresses on their email which aren't necessarily controlled by the server (or datacentre) they're sending mail through. I have mail sent to a domain name I own, but it all gets forwarded to my GMail account; when I reply I do so through GMail and still set my reply-to to use the domain address, but that doesn't mean I'm trying to con people! ;-)

Another thing to check is the various IP blacklists which list IPs known to be used by miscreants... although this predominantly means 'spam' rather than 'fraud'. One overview tool is here: http://whatismyipaddress.com/blacklist-check - and this IP doesn't show up on any of the lists that returned when I checked, which is a good (but again, not conclusive) sign.

 

[RogerS]

Jake

I went to IPLOOKUP.com and this said the IP address was invalid.

I did look to see if there was a website at the address of the sender. The From address is [email protected] (not zzzz!) but there is no website of http://www.zzzzzzzz.co.uk

 

[JakeS]

I went to IPLOOKUP.com and this said the IP address was invalid.

That's a problem with the iplookup.com site, it seems.

The same error is returned if I put an IP address of "46.37.178" in, or "a.b.c.d", which actually are invalid... it seems to be their general "I can't interpret this input as an IP address" error.

For an IP address (at least an IPv4 address, which is what most of the Internet uses) to be 'valid', it just has to be four numbers between 0 and 255, delimited by dots; there are some reserved ranges (like anything starting with a 10, which is intended for local networks), but this IP doesn't fall into any of them. So I don't know why they'd reject it as invalid; it's a perfectly valid address.

I did look to see if there was a website at the address of the sender. The From address is [email protected] (not zzzz!) but there is no website of http://www.zzzzzzzz.co.uk

It's suspicious, but still not really conclusive; there do exist businesses who for some reason think that getting a website is beyond them, but like to have a domain name of their own to use for email. In the same way that there are businesses who have a domain name for their website but still use a hotmail address for their email!

(As it goes, the 'www' part isn't mandatory, and I've certainly seen websites before where "http://www.blah.com" doesn't work and "http://blah.com" does, so you could try that as well.)

If it's a UK domain, you could try going to Nominet and using the whois tool in the top right to get some information about the domain - where it's situated, what the nameservers for that domain are, and sometimes who owns and administers it. If it's a US domain (.com, .net etc.), an equivalent tool is here. You still won't necessarily find anything conclusive, but the more information the better, right?

 

[brianhabby]

If you're are not expecting this email and you don't know the people who sent it, I would just hit the delete key and move on.

regards

Brian

 

[RogerS]

It's not that, Brian. The extract is from an email I got in response to an enquiry I made about a short-term vacancy rental on a flat in Kensington. More research shows there are loads of scammers out there on CraigsList and I think that this is one of them.

The old adage...'if it sounds too good to be true then it probably is"

 

[devonwoody]

If its for a vacancy at the Palace, its dodgy!

 

[WoodMangler]

I went to IPLOOKUP.com and this said the IP address was invalid.

I wouldn't put too much faith in that if I were you...

I've had my fixed IP address since 2009, it's the one used by my business before I retired.

I live in south Wales.
My company registered address is at my accountant in the south midlands.
My ISP is in south-west England.
I've only been to Manchester once in my life, for a motorbike show about 40 years ago.

ip-adress.com, however, is convinced that I'm at Thornton St North, Manchester...