| How to Trace the origin of an EMAIL |
|
|
| Written by Administrator | |
| Monday, 14 November 2005 | |
|
-> When you are suspicious with a particular e-mail. -> When a friend asks you about an e-mail you never send. There are two possible explanations: (1) your computer has been hijacked by nasty viruses/worms and sent out e-mails without your knowing; (2) somebody else uses your e-mail address for the e-mails he/she sent. Whatever the case is, you want to know the truth. -> Someone contacts you for a job offer, and before you want to proceed any further, you may need to know more about this guy. This short tutorial explains the basic of the e-mail system work and how to this knowledge to trace e-mails. Tracing an e-mail is not as hard as you might think. Let's begin to see how it works.
Viewing Email Header Some e-mail programs, like Yahoo or Hotmail, have their full headers hidden by default In order to view the full header, you must specifically turn on that option. Some ways of doing this in different e-mail programs follow here:
Click Options -> Click Mail Preferences -> Click Show Headers -> Click "All" -> Click "Save" Hotmail Click Options -> Click Mail Display Headings (under "Additional Options") -> Click Message Headers -> Click "Full" -> Click "OK" Viewing full Header in Email Clients like (Outlook and Eudora etc) Outlook Express
Outlook
Eudora
Pegasus
Netscape Mail Netscape Messenger 4.0 and 4.5
Now I will discuss the full header in detail:
Headers Created by Sending E-mail Client. Sender e-mail client software may create some of these headers: Date: Original sending date Headers Created by Mail Transfer Agent (MTA). A MTA may create one or some of these headers: Received: This is the most important header created by an MTA. The most used format for this field is: Headers Created by Mail Delivery Agent (MDA). Besides MTA headers above, some MDAs may have anti-spam or anti-virus features in their system. These systems may add some specific headers to an e-mail. Let's trace e-mails Below is a sample of an e-mail header. MIME-Version: 1.0 Let me strip-off the above email header to make the understanding easy. The header is splitted and the two received headers are given below. Received Header 1: 204.127.198.35 - Tue, 25 Nov 2003 19:56:18 -0800 Received Header 2: 68.37.24.150 - Wed, 26 Nov 2003 03:44:57 +0000 The MTAs are "stamped" on the e-mail's header so that the most recent MTA is listed on the top of the header and the first MTA through which the e-mail has passed in listed on the bottom of the header. In the above sample e-mail header, e-mail first passed through 68.37.24.150 (pcp03530790pcs.mnhwkn01.nj.comcast.net), and at last made its way through 204.127.198.35 (rwcrmhc11.comcast.net). In the Received Header 2, the one marked with red colour "pavilion" is either the domain name of the server from which the email has originated or the name of the computer from which the email has been sent. By doing a DNS query for "pavilion", it is confirmed that it is not a know host name hence, must be the name of the computer from which the mail has originated. "68.37.24.150" is the IP address from which the mail might have originated or it is the IP address of the ISP (Internet Service Provider) to which the user was logged on while sending the mail. Note: Correct me if I am wrong, most of the time "HELO" is prefixed to the system name from which the mail has originated, but its accuracy is not reliable.
Trace who owns the IP address Every computers hooked on to internet is assigned with an IP address. Individual users possess a dynamic IP address when they logged on to any ISP to access internet. These IP addresses are assigned by the ISP itself. Organization usually possess static/public IP address which is stored in a database of registries. There are three major registries covering different parts of the world. They are www.arin.net => American Registry of Internet Numbers (ARIN) : It assigns IP addresses for the Americas and for sub Saharan Africa. www.apnic.net => Asia Pacific Network Information Centre (APNIC) : It covers Asia www.ripe.net => R?aux IP Europ?s (RIPE NCC) : It covers Europe Thus, to find out which organization owns a particular IP address, you can make a "WHOIS" query in the database at any of these registries. You do this by typing the IP address into the "WHOIS" box that appears on each of these websites. "Received Header" will have the IP address of the ISP in case the users has dialed up to the ISP while sending the email. But if the user has send the email from within the corporate then the corporate public/static IP address is logged. By giving a "WHOIS" query for 68.37.24.150 at www.arin.net, the following result has been displayed: Comcast Cable Communications, Inc. JUMPSTART-1 (NET-68-32-0-0-1) # ARIN WHOIS database, last updated 2004-02-04 19:15 From above queries it is found that the IP address (68.37.24.150) is owned "Comcast". By making further queries on "Comcast" it is found that it is the name of the ISP located in NJ, US - 08002. The result of further query is given below: OrgName: Comcast Cable Communications, Inc. NetRange: 68.32.0.0 - 68.63.255.255 TechHandle: IC161-ARIN OrgAbuseHandle: NAPO-ARIN OrgTechHandle: IC161-ARIN # ARIN WHOIS database, last updated 2004-02-04 19:15 Now the above case is solved but there are also other cases where the IP address found on the email header may be owned by an organisation or a cyber cafe. Below I have discussed how you can trace the sender in both of these cases. Case1: THE IP ADDRESS OWNED BY AN ORGANISATION But in case the IP address found belongs to an organisation then you have to request them to provide information about the user who has send the mail from within the organisation network. They must have user and message logs on their firewall / proxy and can trace each of their computers connected at the given point of time. By supplying the organisation with the e-mail header of the offending e-mail, they can check these logs and hopefully produce information of the user of that machine. Case 2: THE IP ADDRESS OWNED BY A CYBER-CAFE In case it is found that the sender has sent the email from a cyber-cafe then it becomes a difficult task to trace him/her. The user may not be a frequent visitor to that cyber-cafe. But let's assume that you receive such mails frequently from that particular cyber-cafe then you can install "key-loggers" in the computers at the cafe. These programs records user's keystrokes, thus creating a record of everything that was typed at a particular terminal. By reviewing the key-logger logs you may be able to trace the sender in this case. |
|
| Last Updated ( Sunday, 13 November 2005 ) |
Here I discuss, how to trace an email sender from the email header. I take my MSN account as an example. In some cases, you may want to know the origin of some e-mails:
| < Prev | Next > |
|---|
