Seeing where a mail was sent from?
Discussion
Is there anyway of seeing if a yahoo/hotmail/gmail type mail was sent within the UK? Someone once said that depending upon how the worlds various routers connect together, it can appear to come from anywhere? Not sure if this is true or not?
If I have outlook as my mailbox, how would I go about finding out? Or at best would it just give me the IP address?
If I have outlook as my mailbox, how would I go about finding out? Or at best would it just give me the IP address?
Gmail, no, Originated headers IDs Googles servers,
Hotmail, yes, The originating IP will be either the ISP's external gateway, or the actual users IP.
When you say Outlook I assume you mean Outlook Express. to view the headers select the message and go file => properties => Details => message source.
Find the originiating IP address, then scoot over to www.ripe.net/whois And this will tell you the location of that IP owner.
Yahoo Dunno, I don't use Yahoo.
Hotmail, yes, The originating IP will be either the ISP's external gateway, or the actual users IP.
When you say Outlook I assume you mean Outlook Express. to view the headers select the message and go file => properties => Details => message source.
Find the originiating IP address, then scoot over to www.ripe.net/whois And this will tell you the location of that IP owner.
Yahoo Dunno, I don't use Yahoo.
fergus said:
Someone once said that depending upon how the worlds various routers connect together, it can appear to come from anywhere? Not sure if this is true or not?
this is tosh, as routers don't leave any trace in mail headers, only servers can do that.
It is worth mentioning though, that the SMTP headers format and the protocols for using it correctly are well documented in the RFC's they can be easily configured to say anything, originating IPs and server names are for reference only, not cross checked. This is why spammers are so difficult to track down.
You can fake headers but why bother? I could add 100 fake Received headers to an email, but as soon as it hits another server I no longer have control of what's added.
Ultimately you can only really trust one received header, and that's the topmost one which will have been added by whatever server your email account is on. Any other Received headers will likely be correct, but are not guaranteed to be.
I think I've only ever seen a faked received header once, I can't imagine why you would bother, spammers aren't that bothered about covering their tracks.
Ultimately you can only really trust one received header, and that's the topmost one which will have been added by whatever server your email account is on. Any other Received headers will likely be correct, but are not guaranteed to be.
I think I've only ever seen a faked received header once, I can't imagine why you would bother, spammers aren't that bothered about covering their tracks.
The headers can be forged up until the point they are injected into a "real" SMTP server. At that point, the spammer, or whoever, has no control. So, it is possible, with some common sense, to work out where an email came from. Switch on "Full Headers" in your email client (correctly called an MUA - Mail User Agent, to distinguish from the servers which deliver mail, which are called MTAs - MAil Transfer Agents.) Each MTA adds a line to the headers in the email, saying some thing like;
Received: from pop.mail.somewhere.net (localhost [127.0.0.1]) by postie.zumbruk.com (Postfix) with ESMTP id E4C802BFF2 for <zumbruk@postie.zumbruk.com>; Mon, 17 Apr 2006 19:49:00 +0100 (BST)
There will be one of these lines for each MTA that the email has transited. As someone rightly says, a spammer can forge these lines, right up to the "real" SMTP server, but all the lines after that will be real ones. You need to work your way backwards up the lines, checking that each server is a real one, until you get to one that doesn't exist. The previous one was the place the spam was injected (aka, an "open relay"
If it's a real email, and you just want to know where it came from, all the lines will be real ones, and the top one will tell you the where the email came from.
HTH.
Z.
Received: from pop.mail.somewhere.net (localhost [127.0.0.1]) by postie.zumbruk.com (Postfix) with ESMTP id E4C802BFF2 for <zumbruk@postie.zumbruk.com>; Mon, 17 Apr 2006 19:49:00 +0100 (BST)
There will be one of these lines for each MTA that the email has transited. As someone rightly says, a spammer can forge these lines, right up to the "real" SMTP server, but all the lines after that will be real ones. You need to work your way backwards up the lines, checking that each server is a real one, until you get to one that doesn't exist. The previous one was the place the spam was injected (aka, an "open relay"
If it's a real email, and you just want to know where it came from, all the lines will be real ones, and the top one will tell you the where the email came from.
HTH.
Z.
He he, yeah, I kinda guessed that was what you were after.
Typically, yes it would, but with webmail, it's different. Once you log onto hotmail or gmail your browser is interacting with a server in the states, regardless of where you are in the world. Becuase of that, once you send a mail, the internet thinks you're in the US, which effectivly you are.
As I said above, mail headers are highly configurable, in hotmail MS have chosen to add the originating IP look for the line X-Originating-IP: [nnn.nnn.nnn.nnn] in the message source
(which is nice of them at times like these), and this will give you geographical location. Yahoo and gmail don't do this, so it's game over.
Typically, yes it would, but with webmail, it's different. Once you log onto hotmail or gmail your browser is interacting with a server in the states, regardless of where you are in the world. Becuase of that, once you send a mail, the internet thinks you're in the US, which effectivly you are.
As I said above, mail headers are highly configurable, in hotmail MS have chosen to add the originating IP look for the line X-Originating-IP: [nnn.nnn.nnn.nnn] in the message source
(which is nice of them at times like these), and this will give you geographical location. Yahoo and gmail don't do this, so it's game over.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff