Sunday, April 3, 2011

Backtracking E-MAIL Messages

Tracking email back to its source: Twisted Evil
Cause i hate spammers... Evil or Very Mad

Ask most people how they determine who sent them an email message and the response is almost universally, "By the From line." Unfortunately this symptomatic of the current confusion among internet users as to where particular messages come from and who is spreading spam and viruses.
The "From" header is little more than a courtesy to the person receiving the message. People spreading spam and viruses are rarely courteous. In short, if there is any question about where a particular email message came from the safe bet is to assume the "From" header is forged.
So how do you determine where a message actually came from? You have to understand how email messages are put together in order to backtrack an email message. SMTP is a text based protocol for transferring messages across the internet.
A series of headers are placed in front of the data portion of the message. By examining the headers you can usually backtrack a message to the source network, sometimes the source host. A more detailed essay on reading email headers can be found .
If you are using Outlook or Outlook Express you can view the headers by right clicking on the message and selecting properties or options.
Below are listed the headers of an actual spam message I received. I've changed my email address and the name of my server for obvious reasons. I've also double spaced the headers to make them more readable.

Return-Path:
X-Original-To: davar@example.com
Delivered-To: davar@example.com
Received: from 12-218-172-108.client.mchsi.com (12-218-172-108.client.mchsi.com [12.218.172.108])
by mailhost.example.com (Postfix) with SMTP id 1F9B8511C7
for ; Sun, 16 Nov 2003 09:50:37 -0800 (PST)
Received: from (HELO 0udjou) [193.12.169.0] by 12-218-172-108.client.mchsi.com with ESMTP id <536806-74276>; Sun, 16 Nov 2003 19:42:31 +0200
Message-ID:
From: "Maricela Paulson"
Reply-To: "Maricela Paulson"
To: davar@example.com
Subject: STOP-PAYING For Your PAY-PER-VIEW, Movie Channels, Mature Channels...isha
Date: Sun, 16 Nov 2003 19:42:31 +0200
X-Mailer: Internet Mail Service (5.5.2650.21)
X-Priority: 3
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="MIMEStream=_0+211404_90873633350646_4032088448"

According to the From header this message is from Maricela Paulson at s359dyxxt@yahoo.com. I could just fire off a message to abuse@yahoo.com, but that would be waste of time. This message didn't come from yahoo's email service.
The header most likely to be useful in determining the actual source of an email message is the Received header. According to the top-most Received header this message was received from the host 12-218-172-108.client.mchsi.com with the ip address of 21.218.172.108 by my server mailhost.example.com.
An important item to consider is at what point in the chain does the email system become untrusted? I consider anything beyond my own email server to be an unreliable source of information. Because this header was generated by my email server it is reasonable for me to accept it at face value.
The next Received header (which is chronologically the first) shows the remote email server accepting the message from the host 0udjou with the ip 193.12.169.0. Those of you who know anything about IP will realize that that is not a valid host IP address. In addition, any hostname that ends in client.mchsi.com is unlikely to be an authorized email server. This has every sign of being a cracked client system.
Here's is where we start digging. By default Windows is somewhat lacking in network diagnostic tools; however, you can use the tools at to do your own checking.
We go to google and browse for free whois query
We does whois as     “whois 12.218.172.108”

Result is :-
AT&T WorldNet Services ATT (NET-12-0-0-0-1)
12.0.0.0 - 12.255.255.255
Mediacom Communications Corp MEDIACOMCC-12-218-168-0-FLANDREAU-MN (NET-12-218-168-0-1)
12.218.168.0 - 12.218.175.255
# ARIN WHOIS database, last updated 2003-12-31 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

I can also verify the hostname of the remote server by using nslookup, although in this particular instance, my email server has already provided both the IP address and the hostname.
Go to run and type cmd OR open command prompt there enter
nslookup 12.218.172.108
Result is:-
Server: localhost
Address: 127.0.0.1
Name: 12-218-172-108.client.mchsi.com
Address: 12.218.172.108
Ok, whois shows that Mediacom Communications owns that netblock and nslookup confirms the address to hostname mapping of the remote server,12-218-172-108.client.mchsi.com. If I preface a www in front of the domain name portion and plug that into my web browser, http://www.mchsi.com, I get Mediacom's web site.
There are few things more embarrassing to me than firing off an angry message to someone who is supposedly responsible for a problem, and being wrong. By double checking who owns the remote host's IP address using two different tools (whois and nslookup) I minimize the chance of making myself look like an idiot.
A quick glance at the web site and it appears they are an ISP. Now if I copy the entire message including the headers into a new email message and send it to abuse@mchsi.com with a short message explaining the situation, they may do something about it.
But what about Maricela Paulson? There really is no way to determine who sent a message, the best you can hope for is to find out what host sent it. Even in the case of a PGP signed messages there is no guarantee that one particular person actually pressed the send button. Obviously determining who the actual sender of an email message is much more involved than reading the From header. Hopefully this example may be of some use to other forum regulars.
Enjoy...
Don't forget to comment....

Reactions:

8 comments:

Guo Guo said...

air jordan 4
beats studio
cheap soccer jerseys
true religion jeans
michael kors outlet online
hollister
nike roshe run
mcm handbags
babyliss pro
giuseppe zanotti
lacoste polo shirts
michael kors outlet online
cheap oakley sunglasses
hollister clothing store
air jordan 5
michael kors outlet
lebron james shoes
discount oakley sunglasses
oakley sunglasses
toms
tory burch outlet
calvin klein outlet
michael kors outlet online
louis vuitton
converse all star
louis vuitton handbags
kobe shoes
toms outlet
lululemon
true religion jeans outlet
oakley sunglasses wholesale
thomas sabo uk
coach outlet store
ghd hair straighteners
kate spade outlet
valentino shoes
ray ban
michael kors uk
christian louboutin outlet
cheap oakley sunglasses

xiaozhengm said...

2015-5-29 xiaozhengm
gucci outlet
hollister clothing
ray ban outlet
christian louboutin outlet
true religion outlet
michael kors outlet
cheap ray ban sunglasses
hollister clothing store
kate spade
coach factory outlet
ray ban sunglasses
toms outlet
michael kors handbags
ralph lauren
cheap oakleys
tory burch outlet
oakley sunglasses outlet
air max 90
kate spade uk
polo ralph lauren
soccer jerseys
christian louboutin sale
ralph lauren outlet
coach outlet online
oakley sunglasses
michael kors outlet online
abercrombie outlet
coach outlet
mont blanc pens
burberry sale
gucci outlet
pandora jewelry
burberry outlet online
michael kors handbags

Xiaozhengm 520 said...

2015-10-13 xiaozhengm
air max 95
Authentic Louis Vuitton Handbags Outlet
michael kors outlet
michael kors outlet
Outlet Michael Kors Online
ugg boots
Louis Vuitton Neverfull GM Monogram
nike free run 2,nike free runs,nikes,nike air max 95,nike high tops,air force 1,nike pegasus
michael kors outlet online
michael kors outlet online
coach outlet online
louis vuitton handbags
canada goose outlet usa
michael kors outlet
cheap ugg boots
ugg boots
Designer Louis Vuitton Handbags Online
uggs on sale
timberland boots for men
abercrombie and fitch
Abercrombie Short T-Shirts
ray ban sunglasses
Air Jordan 4 Green Glow
Louis Vuitton Outlet Factory Online
tory burch sale
michael kors outlet
Abercrombie & Fitch Kids Clothing
Authentic Montblanc Pens Sale Online
Air Jordan Shoes For Women And Men
Michael Kors Outlet Handbags Wholesale
Michael Kors Online Store Outlet
louis vuitton
cheap jordans,jordan shoes,cheap jordan shoes
louis vuitton handbags
Louis Vuitton Bags On Sale Cheap

Dong Dong said...

20151130dongdong
ed hardy uk
longchamp outlet
canada goose jacket
hermes uk
jordan 3 white cenment
michael kors outlet
north face jackets
coach canada outlet
sac longchamp pas cher
tommy hilfiger outlet
cheap uggs on sale
cheap jordans
coach outlet
mont blanc pens
coach factory outlet
nike uk
canada goose outlet
running shoes
polo ralph lauren
hollisters
air jordans
michael kors outlet online
coach outlet
christian louboutin outlet
louis vuitton outlet
ray ban sunglasses
tory burch outlet
coach outlet
cheap ugg boots
adidas superstars
caoch outlet
louis vuitton pas cher
ugg outlet
canada gooses
kate spade handbags
ghd straighteners
coach outlet
louis vuitton handbags
jordan 3
michael kors handbags

chenlina said...

chenlina20160304
toms shoes
uggs outlet
kate spade
louis vuitton
ugg boots
ray ban
abercrombie outlet
jordan concords
coach outlet
chanel outlet
oakley sunglasses outlet
ray ban sunglasses outlet
ugg boots sale
cheap oakleys
kobe 10
michael kors outlet
true religion outlet
beats by dr dre
cheap uggs
michael kors handbags
hollister shirts
louis vuitton outlet
michael kors outlet online
ralph lauren uk
p90x
cheap jordans
coach outlet
true religion outlet
tory burch handbags
canada goose jackets
michael kors outlet
cheap ugg boots
tory burch outlet online
louis vuitton handbags
louis vuitton
abercrombie & fitch
nike free runs
ugg boots
oakley sunglasses
coach outlet
as

chenmeinv0 said...

hollister jeans
coach outlet online
fitflops shoes
true religion outlet
adidas nmd for sale
ugg slippers
burberry handbags
rolex watches for sale
moncler soldes
louis vuitton outlet
201610.18chenjinyan

dong dong23 said...

michael kors purses
michael kors outlet
valentino outlet
michael kors handbags
converse sneakers
cheap oakley sunglasses
birkenstock shoes
cheap oakley sunglasses
fitflops sale clearance
reebok sneakers
2017.3.21chenlixiang

风骚污男 said...

20170526 junda
michael kors handbags clearance
polo shirts
coach outlet online
ray bans
cleveland cavaliers jerseys
jordan 4
louis vuitton bags
hermes belts
adidas outlet
mulberry handbags sale

Post a Comment

 
Design by Free WordPress Themes | Bloggerized by Lasantha - Premium Blogger Themes | Web Hosting Bluehost