It’s incredibly easy to send anonymous emails and hide your identity. You can hide your IP address and even make it look like the email comes from a different IP address. Unfortunately, we see many people abuse this to threaten, stalk, or abuse someone online. Of all our cyber investigations, we are most engaged in tracing an email to an IP address or tracing IPs from texts, etc. We deal with tracing anonymous email senders all the time. Often the individuals behind these emails want to torment the receivers and bring fear, frustration, and anger.

If this is your situation, never act from emotions. By reacting with frustrations or anger, you may trigger your antagonist even more, resulting in increased harassment and online attacks.

Before doing anything

Always stay calm and ignore or respond appropriately to anonymous emails. The emails may be disturbing, distressing, or even scary, but responding in anger or abusive language can escalate conflicts and even get you in legal trouble.

Like our founder, who himself was relentlessly attacked through smear campaigns, said:

“Don’t fight fire with fire. In doing so, you simply inspire your antagonist to double his or her efforts. This is even more likely if the antagonist has a narcissistic or anti-social personality disorder, like the individual obsessed with destroying every aspect of what used to be my very normal and boring life. By not fighting back, you take out the sociopath’s glee; the air these people breathe is the outward manifestation of your torment. Just as a cat will stop playing with a mouse when it plays dead, a sociopath will grow bored if unable to elicit painful reactions from a victim.”

Trace an Email

You can trace an email, any email. Anonymity doesn’t exist, not even on the internet.

When it comes to email harassment, we see most antagonists using Gmail and Protonmail. Gmail never includes the IP address, UNLESS the sender sends an email from their phone or desktop client like Microsoft Outlook. In that case, the email header will often include the IP address of the sender. If that is not the case, you can still trace an email.

Why Trace an Email to an IP Address?

By tracing an IP address from an email, you can find out where the sender is based. If you trace an email to an IP address, you can find the location by submitting the IP address on InfoSniper. InfoSniper is an online API geolocation service that geolocates an IP address.

Keep in mind that the sender might hide behind a VPN or other proxies. In that case, the IP address will show a false location.

If you think the sender is someone you know, you can compare the IP address with other emails from that person. Or you can narrow the possibility of that person being the offender down by identifying the location of the sender.

What can an IP address tell you?

You can use an IP address to get an idea of the city someone lives in, and because of this, many websites such as Google keep this information hidden. While an IP in itself can’t be used to track down the owner of an email address, it can be used in conjunction with other methods to identify the email address owner.

If you can trace an email back to an IP address, this will lead you to the account owner. With an IP address, you can find out the location of the sender. Somewhat. The IP address location data DOES NOT provide you with a precise address, but it will lead you to a city. This can help you narrow down your list of suspects.

You can find the location by submitting the IP address on InfoSniper. InfoSniper is an online service that geolocates any IP address.

An IP address will give you basic details about:

The Internet Service Providers’ (ISP) and the organization’s name
The IP’s hostname
The country
The region/state
The City
The estimated latitude and longitude of the location
The area code for that region
Any known services running on that IP

The IP address location data DOES NOT provide you with a street name, house number, or phone number. Tracing an IP will give you the city and the ISP the sender used.

Tracing an IP address from an Email

There are different methods for tracing an IP address from an email. You can trace an email to an IP address by analyzing the full email header, which reveals email metadata and routing information. Usually, you wouldn’t care about this information, but it allows you to trace the email source and provides the data needed to locate the IP address.

Not all email providers give this information in their email headers. In that case, you can either a) ignore the antagonist in the hope it will end, or b) invest in cyber investigators to trace the IP address.

How to find the IP address of the email sender in Gmail

Unfortunately, Gmail does not provide IP addresses in the header in most cases. Unless the email is sent from a phone or desktop client (like Microsoft Outlook). Follow these steps to trace an email to an IP address, if Google provided one.

If you know the ISP of the sender, you can ask the ISP to provide the IP address. Here is an overview of Internet Service Providers and contact details.

How to find the IP address of the email sender in Outlook

Double-click on the email for it to open in a new window.
Click on the three dots in the top right corner. Then click View –> View Message source, which will open the full email header.
Search for “Received: from”. The IP address will show in a series of numbers and dots. If you see multiple mentions of “Received: from” with an IP address, choose the IP address in the last pattern.

How to find the IP address of the email sender in Yahoo Mail

Open the email.
Click on the cogwheel icon with the arrow in the right corner. Click on “more actions”.
Select “View Full Headers”.
Search for “Received: from.” In most cases, the IP address will follow. When you see multiple mentions of “Received: from” with an IP address, choose the last pattern’s IP address. When there are no mentions of Received: from with the IP address, choose the first IP address in X-Originating-IP.

Locate the IP Address of a ProtonMail email

If you are dealing with a ProtonMail sender, you are dealing with a more sophisticated anonymous email sender. ProtonMail is an email service that provides security and anonymity to its users. The emails are encrypted to hide IP addresses.

However, there are still ways to trace an IP address from ProtonMail, though more complicated and time-consuming. With the right cyber investigation tools, we can trace IP addresses from nearly anything: ProtonMail, text messages, social media messages, and we can defeat VPN.

Contact our email tracing specialists

When you received an anonymous email

• Always save the emails and keep a detailed account of all the information you can find. If you decide to take legal action, this information could be very useful.

• When the emails contain abusive language or threats, talk to the authorities.

Trace by IP

There are a few ways to trace by IP.

Trace an Email Sender through a Subpoena

Through a lawyer or law enforcement, you can also subpoena the email provider to release customer information related to the email address. This will often provide you with the IP address you are looking for. They will also release their name, phone number, and more, but often the antagonist does not use their real phone number, name, etc.

When you obtain the IP address, you can subpoena the Internet Service Provider to release information related to the IP address.

Both the email service and Internet Service Provider will try to find any way not to release this customer information because of privacy violations, but we know exactly what to ask for and how. We can help ghostwrite a subpoena that you can give to your lawyer to reduce legal costs. We also ghostwrite subpoenas for law enforcement to minimize their work, which makes it more likely they will take on a case.

The downsides to a subpoena

You can file a civil lawsuit against “John or Jane Doe”, which can issue subpoenas. But the antagonist will know you are coming for them. Because the witnesses, i.e. the telephone number provider, or the app that is being used, will email the registered user letting them know in case they want to challenge or resist the subpoena. In American law, an unknown defendant acting as John or Jane Doe is permitted to respond anonymously and try to have the subpoena quashed. And it is also often more time-consuming and expensive.

However, sometimes the need for a subpoena can’t be avoided. We regularly subpoena ISPs on behalf of our clients and help lawyers with the wording of the request. Because we have done it so often, we know exactly what to ask for.

Trace an Email through Cyber Investigators

If you can’t find the IP address through the email header, we can obtain an IP address. Our cybercrime investigators specialize in obtaining IP addresses through our proprietary cyber crime-fighting software, which allows us to identify anonymous users on the internet. Everything we do is legal, compelling, and admissible in court. We can also defeat proxies and VPNs.

Once we have identified your antagonist, they will often stop their harassment out of fear of legal action. If they continue, our report, affidavit, and testimony allow you to seek injunctive relief through litigation. If you take your antagonist to court, we will work together with your lawyer or the police.

Rule in/rule out

This strategy only works if you have a suspect though. To rule in/rule out, we use a combination of high-tech expertise and old-fashioned instinct. If we can collect the evidence to prove that the suspect is the anonymous user, no subpoenas will be needed, which saves our clients a lot of time and money.

Contact our cyber crime investigators to discuss if and how we can help you identify an email sender.