This might be totally out there and a little off topic but maybe
someone can help me. A couple days ago, a friend of mine had her laptop
stolen. She has AIM on it and she told me that someone with her screen name
just signed on at another location. She only used AIM on her laptop and on
her work computer so it is kind of obvious that it is the person on her
laptop.
If her notebook was stolen, and someone signed on under her screen name to
AIM BTW, (they are very stupid for doing that) unless they used a proxy
with AIM either way, it wasnt the smartest thing to do.
Also, AIM logs all IM sign on & sign off sessions. So he/she who stole it,
is now on a log file on one of the AOL servers. (Evidence)
Is there any way that you guys know of that you could find the IP address of the person using her laptop
Sure. open AIM start a conversation, then open the command prompt and type
netstat -ano
Look for
your IP address in the list then
look next to it, and their will be the
culprits. Also, everything the culprit says can be watched by a
packet sniffer(if you have direct connection thatis) unless, he uses some combination of a *proxy/encrypted client* (like GAIM/trillian).
Another method, setup a webpage/website. A free one from
www.dot.tk (thats what I use)works excellent that captures all 'visitors' IP addresses and their system information.
www.danasoft.com offers the CODE you can place in on yourwebsite for doing this.
Another method, Send the culprit an email.
Social engineering comes to mind here. Have him respond his IP addy will be in the email headers.
and then tracing that in hopes that she could inform local authorities and maybe get it back?
Once you have their IP address, run it through a WHOIS server
http://www.arin.net/whois/ or
www.ip2location.com <--- for a visual layout.
Basically your just querying the IP address to see *WHO* it belongs too.
Once you have this information you can contact the CULPRITS ISP and inform them of whats going on from their local authority, more than likely cops will want serial number off of the notebook, proof of purchase copy of receipt (for ownership, validation, that is) etc....
Cheers, 0X0161