root@boris# whois 62.37.152.243
% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag

% Information related to '62.37.144.0 - 62.37.159.255'

inetnum:        62.37.144.0 - 62.37.159.255
netname:        UNI2-NET
descr:          Uni2 IP Data Network
descr:          Spain
country:        ES
admin-c:        HAF10-RIPE
tech-c:         HAF10-RIPE
status:         ASSIGNED PA
remarks:        For complaints of abuse from these
remarks:        addresses:  abuse@es.francetelecom.com
mnt-by:         UNI2-MNT
source:         RIPE # Filtered

role:           Hostmaster Administrator FTE
address:        Parque Empresarial La Finca
address:        Edificio 9
address:        Paseo del Club Deportivo, 1
address:        28223 Pozuelo de Alarcon
address:        Madrid, Spain
admin-c:        HA1066-RIPE
admin-c:        HA1067-RIPE
tech-c:         HA1066-RIPE
tech-c:         HA1067-RIPE
nic-hdl:        HAF10-RIPE
remarks:        spam, abuse reports....mailto:abuseftes.es@orange-ftgroup.com
abuse-mailbox:  abuseftes.es@orange-ftgroup.com
mnt-by:         UNI2-MNT
source:         RIPE # Filtered

% Information related to '62.37.0.0/16AS12479'

route:          62.37.0.0/16
descr:          Uni2 PA Block 1
origin:         AS12479
holes:          62.37.230.0/24
mnt-by:         UNI2-MNT
source:         RIPE # Filtered


Now that does not mean that the person using it is in Spain. There is a common Internet trick called "anonymous proxy" that allows a user to log into a machine and use that machine's IP address as their own. A person who perpetrates a hate crime like this would use an anonymous proxy to mask their actual location.

My question was really whether it would be worth someone's time to contact the system administrator of the ISP involved to see if they would be willing to check the logs of the machine responding to that IP address to see whether they could find out who was logged into it at the time the message was posted. If you can get a caring system administrator who genuinely wants to help and is concerned about the security of their system, they'll look into it to see if this is due to a misconfiguration of the system and see what they can find out.

If, is as unfortunately likely, the response is "Screw you, why should I worry about some American girl?" or complete silence, this will be a dead end.

As to whether you can email outside of the US, trust me, with commonly available tools you can make an email look like it came from anywhere you want. It is a bit trickier, though not impossible, to actually use an anonymous proxy or misconfigured email server outside the US to send emails. Spammers do this all the time. It looks to me, though, like the address I was chasing was more of a forum post than an email, and if so the actual IP the post came from was logged, though as I said earlier that does not mean the user involved was in Spain when he posted and in fact it's very likely that he wasn't.

I'm doing a panel on Blogs and the Media at VCon, Oct 4, Vancouver BC