Just because an email shows up in your inbox labeled Bill.Smith@somehost.com, doesn’t mean that Bill actually had anything to do with it. Read on as we explore how to dig in and see where a suspicious email actually came from.
Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-drive grouping of Q&A web sites.
N.B For more information and updates visit www.campusflava.com
The Question
SuperUser reader Sirwan wants to know how to figure out where emails actually originate from:How can I know where an Email really came from?Let’s take a look at these email headers.
Is there any way to find it out?
I have heard about email headers, but I don’t know where can I see email headers for example in Gmail.
The Answers
SuperUser contributor Tomas offers a very detailed and insightful response:See an example of scam that has been sent to me, pretending it is from my friend, claiming she has been robbed and asking me for financial aid. I have changed the names — suppose that I am Bill, the scammer has send an email toTwo other contributors, Ex Umbris and Vijay, recommended, respectively, the following services for assisting in decoding of email headers: SpamCop and Google’s Header Analysis tool.bill@domain.com, pretending he isalice@yahoo.com. Note that Bill has forward tobill@gmail.com.
First, in Gmail, useshow original:
Then, the full email and its headers will open:
The headers are to be read chronologically from bottom to top — oldest are at the bottom. Every new server on the way will add its own message — starting withReceived. For example:
Now, to find the real sender of your email, your goal is to find the last trusted gateway — last when reading the headers from top, i.e. first in the chronological order. Let’s start by finding the Bill’s mail server. For this, you query MX record for the domain. You can use some online tools, or on Linux you can query it on command line (note the real domain name was changed todomain.com):
You can trust this because this was recorded by Bill’s mail server fordomain.com. This server got it from209.86.89.64. This could be, and very often is, the real sender of the email — in this case the scammer! You can check this IP on a blacklist. — See, he is listed in 3 blacklists! There is yet another record below it:
but you cannot actually trust this, because that could just be added by the scammer to wipe out his traces and/or lay a false trail. Of course there is still the possibility that the server209.86.89.64is innocent and only acted as a relay for the real attacker at168.62.170.129, but then the relay is often considered to be guilty and is very often blacklisted. In this case,168.62.170.129is clean so we can be almost sure the attack was done from209.86.89.64.
And of course, as we know that Alice uses Yahoo! andelasmtp-curtail.atl.sa.earthlink.netisn’t on the Yahoo! network (you may want to re-check its IP Whois information), we may safely conclude that this email was not from Alice, and that we should not send her any money to her claimed vacation in the Philippines.
No comments:
Post a Comment