Can u tell where an email was sent from?

[PigDogg]

If you recieve an email, can you tell where it was sent from.

Is there a way of finding the IP address and if so would that be the IP address where the email was sent from or the IP address where the Yahoo (or Hotmail or Gmail) was originally signed up from.

If one could get the IP address, how easy is it to narrow down to the city?

[Guest]

If one could get the IP address, how easy is it to narrow down to the city?

Thats the easy part...Locator

[BAM]

Got an email from a girl in Thailand using Hotmail... here is how to learn more about where she is... look at the headers.. this will show you the

Received:
from hotmail.com ([64.4.54.104]) by mail.xxxxxxxxxxxxxxxx.com (Merak 4.2.3) with ESMTP id JFA37105 for ; Tue, 18 Oct 2005 01:13:07 -0700
Received:
from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 18 Oct 2005 00:25:30 -0700
Message-ID:

Received:
from 210.86.146.196 by by20fd.bay20.hotmail.msn.com with HTTP; Tue, 18 Oct 2005 07:25:29 GMT
X-Originating-IP:
[210.86.146.196]
X-Originating-Email:
[[email protected]]
X-Sender:
[email protected]


Look for "X-Originating-IP:[210.86.146.196]" this is her IP... hot Hotmail's. When you use Hotmail or Yahoo you are NOT hidden! Your real IP is passed on.

The Geobyte's program can't trace this IP since it's in Thailand.. it can't get any reverse DNS info... however I could trace route the IP...

Tracing Destination IP: 210.86.146.196

Node 1: (Bam's Computer)
Name: DreamState
IP Address: 192.168.1.100

Node 2:
Name: Bam's Router Gateway
IP Address: 192.168.1.1
RT:0 ms, High:1 ms, Low:0 ms, Avg:0 ms, Total:2, Dropped:0 (0%)

Node 3:
Name: Bam's Uplink
IP Address: 10.95.188.1
RT:None, High:10 ms, Low:10 ms, Avg:10 ms, Total:1, Dropped:1 (100%)

Node 4: Bam's ISP Rogers.com
Name: gw03-vlan201.wlfdle.phub.net.cable.rogers.com
IP Address: 66.185.90.161
RT:None, High:9 ms, Low:9 ms, Avg:9 ms, Total:1, Dropped:1 (100%)

Node 5: Intenet Backbone
Name: gw01-vlan963.wlfdle.phub.net.cable.rogers.com
IP Address: 66.185.93.73
RT:None, High:8 ms, Low:8 ms, Avg:8 ms, Total:1, Dropped:1 (100%)

Node 6: Metropolitan Area Exchange East
Name:
IP Address: 64.71.240.110
RT:None, High:9 ms, Low:9 ms, Avg:9 ms, Total:1, Dropped:1 (100%)

Node 7: Rogers Handoff
Name: gw01.yec.phub.net.cable.rogers.com
IP Address: 66.185.81.190
RT:None, High:22 ms, Low:22 ms, Avg:22 ms, Total:1, Dropped:1 (100%)

Node 8: Chicago Hub
Name: if-6-0.core1.ct8-chicago.teleglobe.net
IP Address: 66.110.27.13
RT:19 ms, High:100 ms, Low:19 ms, Avg:59 ms, Total:2, Dropped:0 (0%)

Node 9: Chicago Outbound
Name: if-0-1.core2.ct8-chicago.teleglobe.net
IP Address: 66.110.27.10
RT:None, High:85 ms, Low:85 ms, Avg:85 ms, Total:1, Dropped:1 (100%)

Node 10: Metropolitan Area Exchange West
Name: if-2-0.core2.cqw-chicago.teleglobe.net
IP Address: 66.110.14.166
RT:83 ms, High:83 ms, Low:83 ms, Avg:83 ms, Total:1, Dropped:0 (0%)

Node 11: Sacramento Hub
Name: if-2-0.core2.sqo-sacramento.teleglobe.net
IP Address: 64.86.83.138
RT:102 ms, High:102 ms, Low:102 ms, Avg:102 ms, Total:1, Dropped:0 (0%)

Node 12: Sacramento Outbound
Name: if-1-0.core1.sqo-sacramento.teleglobe.net
IP Address: 64.86.83.221
RT:85 ms, High:85 ms, Low:85 ms, Avg:85 ms, Total:1, Dropped:0 (0%)

Node 13: Los Angeles Hub
Name: if-1-3.mcore3.laa-losangeles.teleglobe.net
IP Address: 216.6.84.13
RT:88 ms, High:88 ms, Low:88 ms, Avg:88 ms, Total:1, Dropped:0 (0%)

Node 14: Los Angeles Outbound
Name: if-5-0.core1.laa-losangeles.teleglobe.net
IP Address: 216.6.84.18
RT:246 ms, High:246 ms, Low:246 ms, Avg:246 ms, Total:1, Dropped:0 (0%)

Node 15: Los Angeles Teleport
Name: if-5-0.bb3.laa-losangeles.teleglobe.net
IP Address: 207.45.193.98
RT:87 ms, High:87 ms, Low:87 ms, Avg:87 ms, Total:1, Dropped:0 (0%)

Node 16: Los Angeles under Sea Fiber optic Cable.
Name: ix-1-0.bb3.laa-losangeles.teleglobe.net
IP Address: 209.58.85.18
RT:81 ms, High:81 ms, Low:81 ms, Avg:81 ms, Total:1, Dropped:0 (0%)

Node 17: Thailand Teleport
Name:
IP Address: 202.47.253.214
RT:277 ms, High:277 ms, Low:277 ms, Avg:277 ms, Total:1, Dropped:0 (0%)

Node 18: Hub
Name:
IP Address: 202.47.253.147
RT:282 ms, High:282 ms, Low:282 ms, Avg:282 ms, Total:1, Dropped:0 (0%)

Node 19: Metropolitan Area Exchange
Name:
IP Address: 202.47.254.138
RT:287 ms, High:287 ms, Low:287 ms, Avg:287 ms, Total:1, Dropped:0 (0%)

Node 20: Asianet Hub
Name: ppp-203.144.144.29.revip.asianet.co.th
IP Address: 203.144.144.29
RT:280 ms, High:280 ms, Low:280 ms, Avg:280 ms, Total:1, Dropped:0 (0%)

Node 21: Asianet Carrier
Name: ppp-203.144.143.90.revip.asianet.co.th
IP Address: 203.144.143.90
RT:285 ms, High:285 ms, Low:285 ms, Avg:285 ms, Total:1, Dropped:0 (0%)

Node 22: Asianet Bangkok
Name: ppp-203.144.254.142.revip.asianet.co.th
IP Address: 203.144.254.142
RT:284 ms, High:284 ms, Low:284 ms, Avg:284 ms, Total:1, Dropped:0 (0%)

Node 23: Asianet DSL Modem Point to Point Protocol
Name: ppp-210.86.146.196.revip.asianet.co.th
IP Address: 210.86.146.196
RT:354 ms, High:354 ms, Low:354 ms, Avg:354 ms, Total:1, Dropped:0 (0%)


So she lives in Bangkok and has a DSL modem from Asianet. and she used Hotmail to email me however I found out a little bit more. Now Asianet or the Police could find out exactly who this is if they really wanted to.

[Guest]

IP Address: 192.168.1.1

My favorite number! LAN party anyone.LOL

[Snick]

Thats so Class C, I'm 10.0.0.1

[Guest]

HEY!
Wait, whats that anyways?

[BAM]

Thats so Class C, I'm 10.0.0.1

come on man! 127.0.0.1 got a be the best IP to have

[Snick]

127.0.0.1 ? ?
Thats like Masturbating

[BAM]

127.0.0.1 ? ?
Thats like Masturbating

[PigDogg]

When I click on full headers from my Yahoo email, I get two different X-Originating IP's. The sender is the bottom one?


X-Apparently-To:
Authentication-Results:
X-Originating-IP:
Return-Path:
Received:
Received:
Message-ID:
Received:
X-Originating-IP:
X-Sender:
In-Reply-To:
From:
To:
Bcc:
Subject:
Date:
Mime-Version:
Content-Type:
X-OriginalArrivalTime:
Content-Length: 614

[Snick]

Thats a tricky one, each time a message 'hops' from server to server there is the opportunity to rewrite the headers (you SHOULD only update the Received header, but people are nasty). Also A spammer may forge a header in the message and put in invalid addrsses and IPs.

Probably the first one is the more reliable, but can't say for certain.