Most of the people determine who sent them an E-Mail message By the “From” line in E-Mail. Unfortunately this symptomatic of the current confusion among internet users as to where particular messages come from and who is spreading spam and viruses. The “From” header is little more than a courtesy to the person receiving the message. People spreading spam and viruses are rarely courteous. In short, if there is any question about where a particular email message came from then we can only have information from “From” header, which 99.99% times can be forged.
So now how can we really get to know that from where a E-Mail has really came from????!!!!!, we can determine it using a simple E-Mail Tracing technique. We can easily find out the IP from which the E-Mail has been sent from, and from that we can actually know about the Service Provider which has been used by the Sender and also can find the Geographical location of that IP. We can find all of these using E-Mail Header
To get the header from any other E-Mail Service like Gmail, Yahoomail and others follow the instructions:
Below are listed the headers of an actual Spam E-Mail I got. I’ve changed my E-Mail Address and Name for obvious reasons. I’m made the Important sections Bold and marked with Other Colour so that it can be easily found.
From DHL Fri Jun 17 08:37:55 2011
X-Apparently-To: xxxx_xx@yahoo.co.in via 121.101.151.130; Fri, 17 Jun 2011 15:01:44 +0530
Return-Path: <adminsotuipycw@dhl.com>
X-YahooFilteredBulk: 95.105.98.188
Received-SPF: none (mta1014.mail.in.yahoo.com: domain of adminsotuipycw@dhl.com does not designate permitted sender hosts)
X-YMailISG: 7CHT.sAcZArcXSU9MHHNVB7ea5RFL8uFntO1PyY0ozSZ1_kY
1zmUTD8sio_bW2aWr2__Af6atzXHVSKE1J3YMonw.yZ3dsjbhhOCHu0cBY_C
SbktDM03zC.24G26LvVdQZP1CieELOeOyyYMA7loUYIwpBtF9k2IquNgslqW
6Bcks2Hdv4bKyhcW6YP8TCtkZ25LekXkeV_3k7vbM4a1ENe3CsRq9WDfUxV5
NRBaXxft6zb6EUpSlMf_pUkUKuuPaDor5DqNfU7SCj9t3yaObOXkpTOg884A
mBtTPjIn4YAJKy8As6JdtM0HN0An3o47EGu.B6ofhYlot14C69vTfwMyMFiX
EZYG5.DBaqROrmvL.SFBNYtJk6jEemYZerk2PDyCS2cjOUORGUbNm7lBs7Qf
FTXJSvAA5fterZM7ECi4M2vwvj5B99TWGiVI_7PjrTFSGQ9SXtbvGwgFo_Jv
tmLyr4PBew5Yiu.5DA4kNUu39oiXmdpxb8nQzTuEIp8UNQwJUGfhxDB2mMbE
XRdrVosMnU5XVvybqcr3HuFhxNlc6Lc1oTOSosm1emDbI0NNu8m9i3mJ6KcU
_x5o83ZnyMEDGUTzqQi8rdVuwGhBq4b6K.cUwLB15hKvxdFbWWOZK4eIsRRg
5pCMwh81nUasTSqkDRTWhcXeRmNGtSmPNcHyA.AtDInGU0GeBh5oWC0redWr
bdIM8dn.MD6NS3s3Kjd5A.qPDJIizqZonlIKv9tigsP7_Bym6xtjIDD3QA9D
r_o437Ouw0H4SGUfkU3fMSZMXcZLN28zHV_T0N4hXIU_KEAz6zDU_lRvMiyk
UdLPTOZSwSpQh6NOaoR0KihJxOVppwYFrayMU.qkLGIQ4q_CNQ2W7TpzvrVd
rvZ7Wv6U8I3z.L6WC6kuSkDbTPMdJZZy3hJAzeoBMXtj.4PTBRrbkkm.SElg
G8tw5bcXri3lMklV4XTseFhGhIriUjp_1oT.rpmeP.5TiA4K956zugxpLhxR
i4PNYUzXiDCV.EJQwW93PIyWY8MOnhvjTgpkBZw_DeUajsTATa58x8ZtKsTi
qT9ZFFPWGlvr1z3WWInL3uv8Ij84lXTYq.r9OV3cJFkI7zv00SAq4duw.av4
I1RPtp8hSFw9ee.a0l2R9Ldu.y_GnACVnlYqvUBtEhyrRNY.s.A5SDyW3I7T
7RpKP0.3JLjjGTuAEiFZ4d2y4kj18.iT2CiYueL1OJLme2R4SW.Ui57wVaUa
ZW8tyQXy.9bLBvtpmixDuE2rnf56yhhZ5mXclTF6KSpzWMJa6W4sopruEtyj
EFrNXk.QYOrSmhrTYzqoPw75THIop4Xg6JfhdU6lI2Sb
X-Originating-IP: [95.105.98.188]
Authentication-Results: mta1014.mail.in.yahoo.com from=dhl.com; domainkeys=neutral (no sig); from=dhl.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO dhl.com) (95.105.98.188)
by mta1014.mail.in.yahoo.com with SMTP; Fri, 17 Jun 2011 15:01:43 +0530
Received: from group21.345mail.com ([137.24.36.29]) by relay-x.misswldrs.com with LOCAL; Fri, 17 Jun 2011 10:19:31 +0100
Received: from [16.238.233.60] by rsmail.alkoholic.net with ASMTP; Fri, 17 Jun 2011 10:16:04 +0100
Received: from mail.gimmicc.net ([Fri, 17 Jun 2011 10:01:37 +0100])
by mtu23.bigping.com with ASMTP; Fri, 17 Jun 2011 10:01:37 +0100
Received: from external.newsubdomain.com [198.204.245.168] by rly04.hottestmile.com with ESMTP; Fri, 17 Jun 2011 09:44:21 +0100
Received: from mtu67.syds.piswix.net ([Fri, 17 Jun 2011 09:37:55 +0100])
by qrx.quickslick.com with ASMTP; Fri, 17 Jun 2011 09:37:55 +0100
Message-ID: <6b9701cc2cd2$3c4aa160$190b65a7@adminsotuipycw>
From: “DHL” <adminsotuipycw@dhl.com>
To: <srivastavagopi@yahoo.co.in>
Cc: <xxxx_xx@yahoo.co.in>,
<uma_junnarkar@yahoo.co.in>,
<vasanthi_ssa@yahoo.co.in>,
<alsrajeshwari@yahoo.co.in>,
<satish_ronnie07@yahoo.co.in>,
<jitenderthakur1984@yahoo.co.in>,
<satinderhundals@yahoo.co.in>,
<bechundari@yahoo.co.in>,
<omeshmahajan@yahoo.co.in>,
<ms.shivam@yahoo.co.in>,
<sathu_purush@yahoo.co.in>,
<amysak@yahoo.co.in>,
<vicky_vishal_000@yahoo.co.in>,
<mani_elango@yahoo.co.in>,
<rash_sweet90@yahoo.co.in>,
<musicalgirl77@yahoo.co.in>,
<skbadv@yahoo.co.in>
Subject: DHL Express Delivery hau
Date: Fri, 17 Jun 2011 09:37:55 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=”—-=_NextPart_844_A97B_D259C698.2FFE04C8″
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Content-Length: 17531
According to the From header this E-Mail is from “DHL” adminsotuipycw@dhl.com, but is it really sent from there!!!!!!!!…… No No No……
The header most likely to be useful for determining the actual source of the email message. Now look at the “X-Originating-IP: [95.105.98.188]“ it’s on the middle part of the Header. you can see a IP with it, it’s the IP of the original Sender of this E-Mail. Now we need track it, so Go to the www.ip2location.com and copy and paste the IP in the proper field which you found with the “X-Originating IP”, like here it’s 95.105.98.188, now search it and you will get the result. You will be able to see the ISP, Location, Time Zone, Internet Connection and many other Information about the Sender of that E-Mail, and you can even Trace location Geographically with the Map provided in on the Website. In the lower part of the E-Mail you can also see that it’s primarily sent to srivastavagopi@yahoo.co.in and then it has been also sent to all others at the same time what you can clearly see on “Cc” the E-Mail Address list it has with it. So now Trace them out.
Follow Techno Genome at :-
