struggling to understand IP address

mancmanc

I am trying to find out if 2 hotmail emails were sent from the same Ip address, they were sent 3 months apart so it's possible the ip address has changed. looking at the email source, they are quite similar for example it says sender ip is 51.62.26.77 and the other one sender ip is 51.62.67.44

am I looking at the right number and is it likely the same connection if so similar? Also, the computer I am trying to find out if it is sent from, if I check the ip on it, it's nothing like either of them (based on network settings on a computer). I am certain one of the emails was sent on this computer so I dont know if my understanding is wrong, why would it be different to the one showing in hotmail?

PHK

If they are using hotmail, they are probably using webmail. In which case you'd get the IP address of the server not the sender. 

Also, even if they are using an email client then unless they have a static IP address you can't trace it back to one computer as it will change every time you connect (and periodically if you leave it on)

born_again

comment deleted as Op now said not real ip's they are looking at. 🤷‍♀️

https://whatismyipaddress.com/

MattMattMattUK

mancmanc said:

I am trying to find out if 2 hotmail emails were sent from the same Ip address, they were sent 3 months apart so it's possible the ip address has changed. looking at the email source, they are quite similar for example it says sender ip is 51.62.26.77 and the other one sender ip is 51.62.67.44

am I looking at the right number and is it likely the same connection if so similar? Also, the computer I am trying to find out if it is sent from, if I check the ip on it, it's nothing like either of them (based on network settings on a computer). I am certain one of the emails was sent on this computer so I dont know if my understanding is wrong, why would it be different to the one showing in hotmail?

An Outlook(.com) email address, which is what a hotmail address belongs to, does not expose IP addresses. The IP will be that of a Microsoft server. Both those IPs are in a range showing as currently assigned to the DWP, but that could have changed over time. If the emails were sent from an email and that IP is in the header then it would indicate that they were potentially sent from a DWP server, but then they would also need to be from a .gov email address. That being said I and any mildly technically competent person can spoof IP addresses or emails and so they are often useless when trying to work anything out.

What are you actually trying to achieve with this? 

mancmanc

Sorry, I amended the IP addresses to show examples of how similar they are as I didn't want to post the actual IP addresses. its a personal computer where I think 2 emails have been sent from it, by the same person but from 2 different email addresses so showing as 2 different people

MattMattMattUK

mancmanc said:

Sorry, I amended the IP addresses to show examples of how similar they are as I didn't want to post the actual IP addresses. its a personal computer where I think 2 emails have been sent from it, by the same person but from 2 different email addresses so showing as 2 different people

What kind of email are they from? If they are from an Outlook, Hotmail, GMail etc. account then the IP is meaningless, the only way the local IP would be exposed is if they are running their own server and not using any kind of proxy service.  

mancmanc

the are both @hotmail email addresses and would have had to have been sent by logging into the hotmail website as nothing like outlook express set up on the computer

cerebus

So what if it is the same ip address? That doesn't  tell you that the same person sent the email , just the building/pc was used is the same

Do you even know the current ip address of the personal computer (probably changed by now) do you have access to this pc? Is this a family member or work colleague you're snooping on? 

MattMattMattUK

mancmanc said:

the are both @hotmail email addresses and would have had to have been sent by logging into the hotmail website as nothing like outlook express set up on the computer

If they are from Hotmail addresses (which are part of Outlook web service) then the IP in the header is entirely irrelevant, it does not matter if the person was sat in the same building, the same country, or even in the International Space Station, the IP it shows will be that of whatever MS server data connection is handling it at the time. You are not going to be able to trace the sender, or even establish if they are being sent from the same computer or country.

400ixl

When you say the IP address on the device is not the same, that would be as expected.

The device connects to the router and gets an "internal" IP assigned by that (usually a 192.x.x.x address). The router then connects to the ISP and hets given an "Internet" IP address by the ISP network. Depend ing on the ISP, this IP could be dynamic which means it can change each time the router is rebooted or fixed meaning it always gets the same address.

As people have then said, the Hotmail server that is sending the smtp message will have its own IP address, or it could be in a load balanced group or NAT'd which would mean it has a different internal to external address which could be shared by many servers in the hotmail network.

If the IP addresses are in a similar range then they will likely belong to the same ISP or be assigned to a large business.

Try pasting the following into your browser, changing the IP for the real one https://whois.domaintools.com/51.62.67.44