Skip to main content

how do i locate the sender

More
19 years 3 months ago #10031 by constant
day ago i receive unknow email message. my problem is i want to locate the area;city or country where this email come from. your help will be very appreciate.thanks
More
19 years 3 months ago #10036 by Tarun
Ok, i would expand the header of my e-mail.

Look for some thing like:

X-Originating-IP: [202.43.219.155]

in the header itself.

Take the IP go to Dns Stuff & put the IP in the IP Address test, in the WHOIS box & click the button next to it.

That would give me all the information about the location :wink:

Next would be SP (Service Provider)
CCNA, CCNP (Switching), CCIE#20640
More
19 years 3 months ago #10088 by TheBishop
Replied by TheBishop on topic Detective Work
www.samspade.org offers a collection of on-line tools for doing whois lookups etc
More
19 years 3 months ago #10097 by DaLight
You can also download Sam Spade for Windows from the same website which runs on your PC. A very useful tool.
More
19 years 3 months ago #10178 by sahirh
The simplest way for a standard email is

View the headers, locate the last 'Recieved from' header (that means the bottom-most one, when you read the headers from top to bottom). That will say something similar to:

Recieved from x.x.x.x by y.y.y.y via HTTP

That x.x.x.x would be the originating IP.. however, mail relays, proxies etc will complicate this.. thus you look for the X-Originating IP header.

Sahir Hidayatullah.
Firewall.cx Staff - Associate Editor & Security Advisor
tftfotw.blogspot.com
More
19 years 3 months ago #10189 by Tarun

That x.x.x.x would be the originating IP.. however, mail relays, proxies etc will complicate this.. thus you look for the X-Originating IP header.


Well, this post reminds me of the fact "sahirh" that though i know how to decipher a little bit of those headers but there are still some places i falter on. Is there any specific resource where i can find what each & every entry in the header means ?

Thanks...

Next would be SP (Service Provider)
CCNA, CCNP (Switching), CCIE#20640
Time to create page: 0.144 seconds