How do I trace the origin of an email???

[GarrettMacD]

Hi all,
I wonder if someone could help...
I am advertising a car on a couple of internet sites, and have the usual blatant scammers. One guy, however, has emailed me three times, and only now has he mentioned that he doesn't want the private plate, as he wants to export the car. This alerted me straight away as a potential scam, until I realised that his email address originates from EIRCOM.NET, which is the Republic of Ireland's main ISP. This would make sense, as he would have to re-register the car in ROI, so the UK private plate would be 'thrown way'. Is there any way that I can trace whether this guy is actually in the ROI??? The mail address is: [e-mail].
BTW, as I am from Dublin, (now living in Leicester) I can pretty easily get someone to check this guy out, but I need to do some groundwork myself first!!!
Many thanks in advance.

Garrett

[_dobbo_]

ok well it depends a bit on how the email was generated... assuming the best, then there will be an IP address written to the message header which will tell you where it first originated from.

Assuming you use Outlook express, you should be able to right click on the mail in your mailbox, and select "properties"

Now, (i'm doing this from memory so may be wrong) you should be able to see the "message headers" they will look something like this:


Received: from [ 62.55.136.246] by mail.xxxxxxxxxx.co.uk (GMS 11.01.3365/AB0000.00.cb38f070) with ESMTP id qqlyesaa for [e-mail]; Fri, 11 Nov 2005 14:38:42 +0000
Date: Fri, 11 Nov 2005 06:38:21 -0800
Received: from ([ 62.55.136.246] helo=localhost.localdomain)
by scifi.links.org (ecelerity 1.2.12.2 r(5986)) with SMTP
id CF/CC-01737-DDCA4734 for <[e-mail]>; Fri, 11 Nov 2005 06:38:21 -0800
From: popbitch <[e-mail]>
To: popbitch@xxxxxxxx
Subject: "Space baby, yeah!"
Date: Sat, 12 Nov 2005 03:00:00 -0500


Because each new header is added to the top, you need to find the bottom most "Received" header, and take the "from [IP]" bit out of it - it's the IP address you are interested in. Now go to "www.ripe.net" and use the whois tool to lookup the IP address. In this case "62.55.136.246" which resolves as follows:


inetnum: 62.55.136.0 - 62.55.136.255
netname: WORLDWIDE-WEBSIGHTS
descr: Worldwide Websights Ltd
descr: Newlands House Newlands Science Park
descr: Inglemire Lane
descr: East Yorkshire
descr: HU6 7TQ / Hull
country: GB
admin-c: DP2106-RIPE
tech-c: MWH6-RIPE
status: ASSIGNED PA "status:" definitions
mnt-by: MDA-Z
source: RIPE # Filtered


based on what you are saying your email should show it's having come from ireland. Of course this does depend on theinformation being there to start with...

please note i've used my own IP here to "protect the innocent".

[GarrettMacD]

Hi Ben,

Thanks for that - very helpful. One problem though!!! I wasn't using Outlook Express, just my web email address (Hotmail). Can I still get the same info from a message sent to a Hotmail address???

TIA,
Garrett

[_dobbo_]

GarrettMacD said:

Hi Ben, Thanks for that - very helpful. One problem though!!! I wasn't using Outlook Express, just my web email address (Hotmail). Can I still get the same info from a message sent to a Hotmail address??? TIA, Garrett

I'm afraid i don't have a hotmail account so can't answer this. It may have the option to view message headers or message details, but someone else will have to answer that. Sorry!

[GarrettMacD]

_dobbo_ said:

GarrettMacD said: Hi Ben, Thanks for that - very helpful. One problem though!!! I wasn't using Outlook Express, just my web email address (Hotmail). Can I still get the same info from a message sent to a Hotmail address??? TIA, Garrett I'm afraid i don't have a hotmail account so can't answer this. It may have the option to view message headers or message details, but someone else will have to answer that. Sorry!

OK, Ben, thanks for the help anyway.
One of the things that's worrying me is that the reply messages are being shown as (variously)...
Date: Fri, 11 Nov 2005 12:11:42 -0800
Date: Thu, 10 Nov 2005 11:56:18 -0800

It's the -0800 hours that I'm worried about, since Ireland is on GMT. Does this mean that he is sending emails from another time zone, or is that just the time zone where the ISP originates from ???

Thanks,
Garrett

[bigandclever]

Same principles for hotmail ... www.johnru.com/active-whois/headers-yahoo-hotmail.html#hotmail

[GarrettMacD]

bigandclever said:

Same principles for hotmail ... www.johnru.com/active-whois/headers-yahoo-hotmail.html#hotmail

Thanks Jon,
This one actually checks out OK, in that the emails seem to being sent from a PC in Ireland, using an Irish ISP. I'm still not sure about whether it's scam or not, but at least it's not coming from Nigeria!!!

Garrett