|
I frequently get questions that boil down to How can I trace where this email came from? or Can I determine the IP address of the sender of an email?. The answer is both yes and maybe, and it may not do you any good. However there is a lot of interesting information in your email that you normally don't see, and the trail of mail servers is part of that. So let's interpret some email headers. First, there's the challenge of even getting to the real email headers. In Hotmail they're apparently always visible. In Outlook, they're hidden by default, so with the message open, click on View, and then Options, and you'll see a box labeled Internet Headers. In Thunderbird, you can expand or collapse the headers by clicking on a simple control next to the subject line. In any case, headers typically look something like this:
Now yours may look a lot different. It may be longer or shorter, or have additional information, or less. But the basic idea is that there's a lot of information in the headers that has to do with the administration of getting the email from the sender to the receiver. A detailed reference is more than I can present here, and quite honestly, probably more than you need. But let's examine the headers above a little more closely, since it's a good example of a "normal" email messages. They are from a message I sent to my regular email account from my Hotmail account. A good rule of thumb is to begin at the bottom and work your way up in the headers. That'll make more sense in just a minute. Working from the bottom:
The series of "Received" headers are the trail that tells us from where the message was sent, and along what path or series of servers it traveled across the internet. And this is why we started at the bottom, as each mail server adds a received header to the top. In the first one we can see that a Hotmail server "by107fd.bay107.hotmail.msn.com" got the message from the server at "64.4.51.220". In this case it lists an IP address only, since there is apparently no name associated with the server at that address. Since this is Hotmail, and I'm certain that Hotmail has many, many servers, it's not surprising that they might not give all of them a name on the internet. Further up the header we can see that it left "bay107-f18.bay107.hotmail.com" and was then received by "pugetsoundsoftware.com", my mail server. Note that this line also includes a couple of interesting bits of information:
As part of spam prevention and server authentication, a mail server may elect to ensure that all three of these pieces of information match: the IP address reported matches the server name reported, which in turn should match the end of the HELO string. In practice, the internet is a little too fast and loose for that to be a reliable gauge of authenticity ... to many legitimate servers are not configured to report the right information for that check to always be valid. Another interesting use of the Received headers is to determine where a delay may have occurred in transferring the mail. Since each is time-stamped, it's quickly apparent where a message may have been held up. Now lets look at the headers of some SPAM I recently received:
[Note: everything that says "fake" is something I changed to anonymize this example. Someone's real email address and real company domains were used in the original.] There are several interesting things about these headers:
The kicker is that the links for the products being sold by this email all go to a domain registered in Bulgaria. So what to make of it all? It is possible that the originating computer, desk.fakemailer.com, is, in fact, sending out spam on purpose. It's also possible that this machine has been infected with a virus, and is sending out spam without realizing it. And yet another scenario is that the machine is not involved at all, and that spammers in Bulgaria have spoofed the headers of the originating machine (using the companies role in the bulk email business to confuse and obfuscate the issue). And therein lies the problem with SPAM and why there's no simple solution. Email headers cannot be trusted, and not all email can be traced or authenticated. Legitimate mail typically can be traced, but for SPAM and virus-generated email it's difficult to say that the headers are absolutely trustworthy. But it's interesting information, nonetheless. Related:
• Recent Comments
HI Leo, I received a strange email from someone claiming to know me. When I checked the IP address of the email, the X-Originating IP matches mine exactly! How is that possible? Posted by: Erin at June 16, 2008 06:20 PMI need to know in plain english if there is a way I can tell where(physical address or at least city) of an email Posted by: mary at June 18, 2008 12:13 PMI received an email from someone who said he was in a certain city. I checked his IP address and did an IP and e-mail trace, and it showed he was not in that city. How can this happen? Posted by: Rachael Landes at June 18, 2008 07:45 PM-----BEGIN PGP SIGNED MESSAGE----- Mary: in plain English: no. Leo
iD8DBQFIWo1ACMEe9B/8oqERAkcpAKCG9UoPEOIWC6eQyK5+ZwioddgztwCdFfS7 How can i see an ip address on aol...all the emails say HIDE when on click on MORE DETAILS? Posted by: vince myers at June 24, 2008 07:47 AMCan someone track the originating IP or computer where an email was sent or created from ONLY having the email address and no header or IP?? What if this person works for a phone company? Thanks Posted by: Patricia at June 25, 2008 10:07 AMWhat does the "IP host" information tell you, other than the ISP.. can the ISP track physical address of a computer?? isnt this some invasion of privacy? Posted by: Patricia at June 25, 2008 10:15 AMI trace spam emails to their ISP's by using these free tools. IPNetInfo and a program called Abuse. Abuse is a free application that scans the headers of emails and comes up with the ISP the mail was sent from. It then sends in a preconfigured complaint letter to the Abuse Dept. of that provider.I have gotten over 2000 IP addresses disconnected so far in my 2 year fight against these scumbags. So long as they continue to spam me I'll gladly let the ISP aware of it. here is the link for ABUSE Program...http://spam-abuse.sourceforge.net/about_us.php. IPnetInfo is easy to find. Google it. Get a Spam Filter as well. I use MailWasher Pro. Hope that helps. Posted by: RobMarson at July 3, 2008 02:38 AMOops...I forgot this part. If I feel that ABUSE isn't showing ALL the info, I then use IPNetInfo to scan the IP addresses and weblinks in the headers. Not only does it find the info I need but it also confirms what ABUSE found. Posted by: Rob Marson at July 3, 2008 02:44 AMPost a comment on "How can I trace where email came from?":
|
Archives Advertisers |