Trace an e-mail from Hotmail

[wimiadmin]

AboveTheLogic and I did a little test with Hotmail. I sent him an e-mail from my Hotmail account using the Windows Live Mail application (the replacement to Outlook Express) installed on my laptop from my home network.

When he received the e-mail, my IP was in the X-Originating-IP in the message header.

I then logged into the Hotmail website and sent another e-mail from there. Low and behold, my IP was still in the X-Originating-IP section.

So, without a doubt, we've proven that an IP can be traced from Hotmail. However, if the person logs in to Hotmails website from a Proxy may prove differently.

Brian

[waelanwar]

kindly,
could you explain that method

[AboveTheLogic]

You need to look at the email headers, usually there is an option in the "View" menu of whatever email client you are using.

I'm not sure if you can do it with webmail, I don't think you can...

[aziernest]

Hi WIMIadmin & AboveTheLogic,

Today, I was just trying to check an email header and I see that there is no option in hotmail that allows you to see x-originating IP.
Upon my research I have observed that the "Classic" version of hotmail webmail do not gives you an option to see header, if you want to see headers you must have to switch to full version.
Below are the steps required to check headers of an email received at hotmail.


• Log into Hotmail.
• Click on "Options" tab on the top navigation bar.
• Under Options you will see the following message, "You are using the classic version of Windows Live Hotmail. Have a fast connection and want more features? Try the full version to see message previews in your inbox. (It's free, too.)"
• Click on the "Try the full version" link.
• Click on "I want the Free Upgrade..", button
• To view the full email message header, right click the email message displayed in your list of messages. A menu will pop-up. Click on the View source option in this menu, and a new window will open. This window will display the full email headers.

Hope it helps

[AboveTheLogic]

That's pretty cool (although I haven't tried it myself).

I generally just use an email client to read headers, but if you can do it in the web interface that could be considerably easier.

[romantic]

here you will notice that X-Originating-IP is the sender's real ip

Delivered-To: Receiver@gmail.com
Received: by 10.223.109.197 with SMTP id k5cs86093fap;
Fri, 12 Dec 2008 18:14:16 -0800 (PST)
Received: by 10.141.168.2 with SMTP id v2mr2235321rvo.207.1229134454909;
Fri, 12 Dec 2008 18:14:14 -0800 (PST)
Return-Path: <sender@msn.com>
Received: from col0-omc4-s17.col0.hotmail.com (col0-omc4-s17.col0.hotmail.com [65.55.34.219])
by mx.google.com with ESMTP id k41si1851576rvb.6.2008.12.12.18.14.14;
Fri, 12 Dec 2008 18:14:14 -0800 (PST)
Received-SPF: pass (google.com: domain of sender@msn.com designates 65.55.34.219 as permitted sender) client-ip=65.55.34.219;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of sender@msn.com designates 65.55.34.219 as permitted sender) smtp.mail=sender@msn.com
Received: from COL109-W25 ([65.55.34.201]) by col0-omc4-s17.col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 12 Dec 2008 18:14:14 -0800
Message-ID: <COL109-W25C>
Return-Path: sender@msn.com
Content-Type: multipart/alternative;
boundary="_f21ea94b-fdd8-4da-724c158f2860_"
X-Originating-IP: [116.71.1XX.XXX]
From: sender <sender@msn.com>
To: <Receiver@gmail.com>
Subject: ip test
Date: Sat, 13 Dec 2008 07:14:14 +0500
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 13 Dec 2008 02:14:14.0368 (UTC) FILETIME=[7E950600:01C95CC8]

[neo17]

hi, i am trying to find the X-Originating-IP in my hotmail account. i right click the e-mail on the list of mails and then in the popup window i select the source. i can see all the html code, but i cant find the part of the X-Originating-IP, can anyone help me??

[AboveTheLogic]

you probably need to use an email client like thunderbird

[neo17]

thnx it is working

[AboveTheLogic]

glad to hear