Trace an e-mail address

[dscott@work]

Just a caveat...Anything you view inside the email (body or headers) can be spoofed. Or to say it another way, the email you receive in your Inbox contains everything that the sending server transmits following the SMTP DATA command/verb. There is no requirement that anything inside this "email envelope" (the RFC822) must be accurate. The data that follows the DATA command can be true or false, depending on the design of the MTA application that is sending it. Some sending MTAs routinely (and correctly) declare the source IP address. But that IP address is not *necessarily* correct. What *cannot* be spoofed is the IP address which the sending MTA provides in the original TCP connection--(the sending MTA must tell the receiving MTA where to reply with its ACK packets). This server-to-server negotiation of the delivery of the email is controlled by the RFC821 protocol. The RFC821 (delivery) protocol and RFC822 (envelope packaging) protocol are two entirely different things.

[AboveTheLogic]

how do you know that you are not receiving all the emails?

spoofing emails (sending fake emails that appear to have originated from your address) is relatively easy to do

intercepting incoming emails is much more challenging... unless, of course, the "hacker" has your password

try changing your password

[lifetoaster]

Hi guys,
I am new here and have a quick question.
Suppose I use a tunnel proxy like 'freegate' and send mails , then would anyone at the least chance get to know that I sent it?

PS: freegate is a small app used to get u into tunnel proxy

[AboveTheLogic]

totally depends on how secure the proxy is and how motivated the recipient is...

try to send yourself an email through the proxy and take a look at the headers, see what kind of stuff is in there...

[Thomas Delbeke]

Hi there,

I received an abusive email from:

from (van) 波 周 <email>
Antwoorden op email
aan Thomas Delbeke <email>
datum 11 januari 2009 15:15
subject (onderwerp) 回复： [Launchpad-users] ddebs
ondertekend door yahoo.com.cn

How to trace the IP , DNS , traceroute?

Thanks,

Thomas

[wimiadmin]

Hi Thomas,

The first post in this thread tells you to right click the email and choose "options" or whatever menu choice to get you to the message header.

Then in the message header, you'll see an IP where the email came from....probably called "Received From".

You can go to arin.net and see who that IP belongs to. Since the email listed in your post is yahoo.cn, if they're telling the truth, it's possible it came through yahoo servers. If that's the case, you'll get no where.

The best this is to just file it as junk and move on.

However, if you're crafty....and I've done this before and it worked. Let's say your email address is something @ hotmail.com. Send an email to asdlkfjasodifjapodijf@hotmail.com to get a bounced email. Get all the particulars. Then, when another email from this person comes in, you set up your account to be the Postmaster and send them an undeliverable that your account is no longer active or available or whatever the bounced message says that you get. The spammer will think your email doesn't exist, they'll delete your address and move on.

[Thomas Delbeke]

Hi WimIadmin.

That is a Dutch name, are you Dutch?

No, I was not talking about a spam email. Somebody was trying to harass me on launchpad user-digest mailing list. I read your first post and all others. My question was not clear, I apologize. I cannot find the IP address. It is a Yahoo! email, but I received it on my gmail account, is there a way to trace this. I am fairly sure that it is a user that posts regularly on this list. The message (in bad Chinese, with comma and three exclamation marks) reads: "Your his mother sb, passing on the junk mail !!!".

Note that I do not need the IP in essence,

If I can compare IP, DNS IP , traceroute or anything like that, it will be enough to compare the two email adresses.

This would help me so much, thank you!

Thomas

[wimiadmin]

Hi Thomas,

Not Dutch...sorry. It stands for WIMI Admin and WIMI represents WhatIsMyIp

Ok....to find out what IP the email came from, on your gmail page, open the email. In the upper right corner, there is a Reply link with a down arrow just to the right of it. Hit the down arrow and choose Show Original.

Now you can see the message header and find out what IP the message was sent from by looking at the "Received From" IPs.

Not sure if Yahoo masks the originating IP like gmail does.

Brian