ATEK Death threats: A Whodunnit?!
I was informed of the death threat against ATEK President Greg Dolezal shortly before they hit the Korean blogosphere last week. At first, I thought it may be an AES nutjob gone postal, but after Mr. X a Dave’s ESL Cafe poster called JohnFlory decided to try and pin the blame on me, I spent a few minutes (and really, that was all it took) to take a deeper look.
Here is what I did:
- I got the email address from the AES site.
- I plugged that address into Facebook.
Simple right?
The email address is linked to somebody in the US. Whilst their profile is locked, I could browse their friends. Total friends outside of the US: 0
If the AES email address and the one received by ATEK are one and the same, then the address has probably been spoofed. It is highly unlikely that this person even knows of ATEK, and I doubt a US citizen would knowingly allow his email to be used to send death threats to South Korea. If this is the case, it is pretty easy to find out where it originated.
Spoofing an email is pretty easy, especially if you use gmail. The good news is, the header information of any gmail mail sent from outside of gmails browser composer will contain ip address information (though posting from within it will hide the original ip).
Open up the header and look for the ip. Check it was not sent via proxy (though a proxy would not usually hide the originating ip) by googling the ip along with the word “proxy”. If it passes that check, enter the ip into a site that tells you where it is located, and you have just narrowed down your search.
As I found when I had to track down a message supposedly left by the AES leader (though it turned out to be Mr. X somebody else), Korean ip traces are very effective: if the person used a PC bang, the name and address of the business will show up on the trace. From that, you can get access to their CCTV and find out exactly who it was.
Happy hunting!
Tags: ATEK, criminal, Korea, police