How to ID origin in email headers?

I am sure this is the wrong place for this question but you guys know a lot
about header information so could someone please direct me to the
appropriate newsgroup to ask this question in?

I am trying to rent a room and places some ads online like craigslist and
have gotten a few replies from overseas that seem very sincere but never
amount to anything other than email chat on yahoo or hotmail email
accounts. They show a genuine interest in renting, write back and forth,
and are either supposed to be the UK or the other one is in Benin Republic.
I can find no way in the hotmail or yahoo mail to trace the origin of such
emails. I had thought that the Date line would give it away as the both of
them show lines like:
Date: Tue, 4 Dec 2007 10:05:46 -0800 (PST)
But my brother is in Panama and when he writes through yahoo, it is the
same thing and Panama sure is not -8 Hrs, Pacific Standard Time, Panama is
-5, EST just like me.

Is there anyway to track the origin of a hotmail or yahoomail email through
the headers or can it not be done? I am sorry to ask this question in this
group if it is not appropriate, please direct me to the appropriate
newsgroup if I am off base here. Thank you for your time.

--
~Ohmster | ohmster /a/t/ ohmster dot com
Put "messageforohmster" in message body
(That is Message Body, not Subject!)
to pass my spam filter.

Re: How to ID origin in email headers?

On Tue, 04 Dec 2007 21:03:36 +0100, Ohmster wrote:

> Is there anyway to track the origin of a hotmail or yahoomail email
> through the headers or can it not be done? I am sorry to ask this
> question in this group if it is not appropriate, please direct me to the
> appropriate newsgroup if I am off base here. Thank you for your time.

Yahoo mail, at least with no javascript enabled, has a link "Full
Headers" directly under the "Mark as Unread" button.

Sample:

From tijan sule Tue Dec 4 08:19:14 2007
X-Apparently-To: daveuhring@yahoo.com via 68.142.200.160; Tue, 04 Dec 2007 08:29:09 -0800
X-YahooFilteredBulk: 65.54.246.169
X-Originating-IP: [65.54.246.169]
Return-Path:
Authentication-Results: mta315.mail.re4.yahoo.com from=hotmail.com; domainkeys=neutral (no sig)
Received: from 65.54.246.169 (EHLO bay0-omc2-s33.bay0.hotmail.com) (65.54.246.169) by mta315.mail.re4.yahoo.com with SMTP; Tue, 04 Dec 2007 08:29:09 -0800
Received: from BAY106-W40 ([65.54.161.140]) by bay0-omc2-s33.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 4 Dec 2007 08:19:24 -0800
Message-ID:
Return-Path: tij71a@hotmail.com
Content-Type: multipart/alternative; boundary="_4c6b8c8c-be8b-409f-88dc-f1a247df64f5_"
X-Originating-IP: [212.52.134.213]
Reply-to:
From: "tijan sule"
Subject: Please, I need your urgent respond
Date: Tue, 4 Dec 2007 16:19:14 +0000
Importance: Normal
MIME-Version: 1.0
Bcc:
X-OriginalArrivalTime: 04 Dec 2007 16:19:24.0676 (UTC) FILETIME=[6F5FB440:01C83691]
Content-Length: 7810

That one came from hotmail but was posted from 212.52.134.213, which
resolves to: not found. However, whois indicates that it came from
somewhere in Africa.

Re: How to ID origin in email headers?

I have to post through google groups. For some reason, my real
newsreader stalls on this followup and I have no idea of why.

Dave Uhring wrote in news:
13lbf0bnthhrm31@news.supernews.com:

Thank you for writing Dave. Hey, your reply did not word wrap for
Usenet posting. That is pretty neat for stuff like this, how did you
do it? Oh there is a word wrap option in Xnews, duh!

> On Tue, 04 Dec 2007 21:03:36 +0100, Ohmster wrote:
>
>> Is there anyway to track the origin of a hotmail or yahoomail email
>> through the headers or can it not be done? I am sorry to ask this
>> question in this group if it is not appropriate, please direct me to the
>> appropriate newsgroup if I am off base here. Thank you for your time.
>
> Yahoo mail, at least with no javascript enabled, has a link "Full
> Headers" directly under the "Mark as Unread" button.
>
> Sample:
>
> From tijan sule Tue Dec 4 08:19:14 2007
> X-Apparently-To: daveuhring@yahoo.com via 68.142.200.160; Tue, 04 Dec 2007 08:29:09 -0800
> X-YahooFilteredBulk: 65.54.246.169
> X-Originating-IP: [65.54.246.169]

This is good, you have an X-Originating-IP in your headers. Very
useful.

> Return-Path:
> Authentication-Results: mta315.mail.re4.yahoo.com from=hotmail.com; domainkeys=neutral (no sig)
> Received: from 65.54.246.169 (EHLO bay0-omc2-s33.bay0.hotmail.com) (65.54.246.169) by mta315.mail.re4.yahoo.com with SMTP; Tue, 04 Dec 2007 08:29:09 -0800
> Received: from BAY106-W40 ([65.54.161.140]) by bay0-omc2-s33.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 4 Dec 2007 08:19:24 -0800
> Message-ID:
> Return-Path: tij71a@hotmail.com
> Content-Type: multipart/alternative; boundary="_4c6b8c8c-be8b-409f-88dc-f1a247df64f5_"
> X-Originating-IP: [212.52.134.213]

You have another X-Originating-IP:, how come there are two of them and
which one is the one where the message actually did originate from?

> Reply-to:
> From: "tijan sule"
> Subject: Please, I need your urgent respond
> Date: Tue, 4 Dec 2007 16:19:14 +0000
> Importance: Normal
> MIME-Version: 1.0
> Bcc:
> X-OriginalArrivalTime: 04 Dec 2007 16:19:24.0676 (UTC) FILETIME=[6F5FB440:01C83691]
> Content-Length: 7810
>
> That one came from hotmail but was posted from 212.52.134.213, which
> resolves to: not found. However, whois indicates that it came from
> somewhere in Africa.
>

Now I see how you did that and that was very good Dave. Thank you for
the lesson. I am not sure what mail client you use or if it makes a
difference or not. I think you said you recieced this on yahoo mail
and that they have a "Full Headers" button that you can click to see
all of the headers. I get my mail delivered to Outhouse Express and
they have a similar feature, hold Control and press and release F3 to
see the original contents of the raw mail, including all headers.

I really have to get this room rented and do not want thee apparent
fakers wasting my time saying they want to rent the room and that a
deposit and itinerary is on the way, etc. They are just holding me up
for nothing, one of them even wants for me to take down all the room
for rent ads because she "assures me" that she does indeed want the
room and that her company will take care of the room fees and flight
fare. That all sounds nice but it is not enough to get her a room nor
will it get me to take down the advertisments. This is the Benin
Republic lady, that is in Africa, off the coast of Nigeria. She uses
the yahoo account, the UK lady uses a yahoo account too. I have looked
at the full headers but could not find an originating IP like you have
in your headers. Here are the samples, one from hotmail in the UK and
one from Benin Republic in Africa...

First is the yahoo mail from the UK as follows:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++
++++++
Received: from imta15.emeryville.ca.mail.comcast.net ([76.96.30.54])
by alnrmxc16.comcast.net (alnrmxc16) with ESMTP
id <20071203160619a16007qlbfe>; Mon, 3 Dec 2007 16:06:20
+0000
X-Originating-IP: [76.96.30.54]

Okay, here is an originating IP, I wonder if this is "the real one" or
not? Let's do a lookup.
76.96.30.54 is found in United States
Does not sound like the UK to me, but that is Comcast. I am the one
with the Comcast address.
This is not the header I am looking for.

Received: from n10.bullet.re3.yahoo.com ([68.142.237.123])
by IMTA15.emeryville.ca.mail.comcast.net with comcast
id LG6K1Y0132gRm700000A00; Mon, 03 Dec 2007 16:06:24
+0000
X-Authority-Analysis: v=1.0 c=1 a=2Y/dw/ke3FdSlCMm99OGAQ==:17
a=uLeiUHzoPSgNHYuRj9UA:9 a=c4sOA3dO-d-fypxhysETsegIumkA:4
a=9OHTkwyHC8cA:10 a=CjxXgO3LAAAA:8 a=Dnf9-rMScLbEmipeuw0A:9
a=r808nDooRhxKP1wUjYsA:7 a=8pTbpiky3KIN6Z0ioLlbVBPoHGAA:4
a=qJMeZhlYfXQA:10
Received: from [68.142.230.29] by n10.bullet.re3.yahoo.com with NNFMP;
03 Dec 2007 16:06:17 -0000
Received: from [216.252.122.217] by t2.bullet.re2.yahoo.com with
NNFMP; 03 Dec 2007 16:06:17 -0000
Received: from [69.147.84.34] by t2.bullet.sp1.yahoo.com with NNFMP;
03 Dec 2007 16:06:17 -0000
Received: from [127.0.0.1] by omp210.mail.sp1.yahoo.com with NNFMP; 03
Dec 2007 16:06:17 -0000
X-Yahoo-Newman-Property:
ymail-3
X-Yahoo-Newman-Id:
254658.58767.bm@omp210.mail.sp1.yahoo.com
Received: (qmail 69161 invoked by uid 60001); 3 Dec 2007 16:06:17
-0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:Date:From:Subject:To:In-Reply-To:MIME -
Version:Content-Type:Content-Transfer-Encoding:Message-ID;
b=JeLupjSkx2LSK2hU/8UseGgqzPu7RKJrgXNWPSIbFq0xi
+CyNrmJMrBYVXoXLJ9M0m9eC3ZTC2rkm1WzQSWAkaf5T66sIXAnh4IO7FsG1 HFzODOHqP
+q069DLi+VWdWOmSVj8TGJcpnq7ZW8ZtXVH45151n6n6ugdwIoAqXufJA=;
X-YMail-OSG:
HPvXQKsVM1lTLSrGFAjVOMU7iVuAg_lE1.rxkLzz6HuJcY7rSLVvhfdlbh4_ mUtv_hMTozPg5kVso.msRbqq2haG_Q--
Received: from [82.128.14.18] by web45404.mail.sp1.yahoo.com via HTTP;
Mon, 03 Dec 2007 08:06:16 PST

Okay let's try this one, 82.128.14.18.
Lookup Service: http://www.webyield.net/domainquery.html
IP Address: 82.128.14.18
Hostname: no reverse DNS for this IP
Try a country lookup: IP is not in database!
Query took 0 ms
Big Zero on that one. Try a different lookup service.
http://www.ip2location.com/free.asp
IP Address Country (Short) Country (Full) Flag Region
City ISP Map
82.128.14.18 NG NIGERIA - - MULTI-LINKS TELECOMMUNICATIONS LIMITED

Don't sound like the UK to me. Do you believe this email originated
from Nigeria or the UK, Dave?

Date: Mon, 3 Dec 2007 08:06:16 -0800 (PST)
From: natasha rudney
Subject: Re: Are you okay Natty?
To: Ohmster
In-Reply-To:
<002601c83504$b3316800$0300a8c0@MISSY>
Message-ID: <988971.68323.qm@web45404.mail.sp1.yahoo.com>
X-Antivirus: AVG for E-mail 7.5.503
[269.16.13/1167]
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="=======AVGMAIL-475438FB2AB3======="
X-Bayesian-Result: Clean
(0)
X-Bayesian-Words: 7.5.503 24 available 28 checked 21 come 0 database
21 dear 70 easy 0 edition 21 even 0 favorites 1 found 21 free 13
getting 12 homepage 0 incoming 21 interested 15 make 18 natty 5 okay 0
one-click 0 over 16 paul 0 preparing 13 release 21 room 0 states 1
still 17 thanks 9 tomorrow 0 version 23 very 0 virus 21 weekend 1
yahoo 0 yahoo! 1
X-HTMLM-Score:
0
X-P2P:
PASS
X-SpamPal: PASS A-WLIST
EMAIL
X-Wlist-Pattern:
nattyrud001@yahoo.com

--=======AVGMAIL-475438FB2AB3=======
Content-Type: multipart/alternative; boundary="0-467846708-1196697976=:
68323"

--0-467846708-1196697976=:68323
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++
++++++
Those are the headers above from the UK lady that desperatly wants to
rent a room. Do you believe this is
a genuine UK email Dave or not?

Next is the yahoo mail from Benin Republic in Africa
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++
++++++
Delivered-To: ohmster59@gmail.com
Received: by 10.141.52.7 with SMTP id e7cs178106rvk;
Tue, 4 Dec 2007 04:06:30 -0800 (PST)
Received: by 10.100.211.8 with SMTP id j8mr1200062ang.1196769990175;
Tue, 04 Dec 2007 04:06:30 -0800 (PST)
Return-Path:
Received: from n7.bullet.re3.yahoo.com (n7.bullet.re3.yahoo.com
[68.142.237.92])
by mx.google.com with SMTP id 8si345283agd.
2007.12.04.04.06.27;
Tue, 04 Dec 2007 04:06:30 -0800 (PST)
Received-SPF: pass (google.com: domain of tranes111@yahoo.com
designates 68.142.237.92 as permitted sender) client-ip=68.142.237.92;
DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
tranes111@yahoo.com designates 68.142.237.92 as permitted sender)
smtp.mail=tranes111@yahoo.com; domainkeys=pass (test mode)
header.From=tranes111@yahoo.com
Received: from [68.142.230.28] by n7.bullet.re3.yahoo.com with NNFMP;
04 Dec 2007 12:06:26 -0000
Received: from [216.252.122.216] by t1.bullet.re2.yahoo.com with
NNFMP; 04 Dec 2007 12:06:26 -0000
Received: from [69.147.65.174] by t1.bullet.sp1.yahoo.com with NNFMP;
04 Dec 2007 12:06:26 -0000
Received: from [127.0.0.1] by omp509.mail.sp1.yahoo.com with NNFMP; 04
Dec 2007 12:06:26 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 12495.94656.bm@omp509.mail.sp1.yahoo.com
Received: (qmail 40689 invoked by uid 60001); 4 Dec 2007 12:06:25
-0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:Date:From:Subject:To:In-Reply-To:MIME -
Version:Content-Type:Content-Transfer-Encoding:Message-ID;
b=HP6tvp8cPSUvWnE399+nWq7XnFBWZE7OY2fFuT3iu7OkcoCHgnzw82ddjV wS
+wCZ1YiArDSf3Tfy0o2YE+AKeftthqxK1Sn/SI4QF2M+4xUvp7JtR9rYJRv
+OBuv4uHCzqVk0P/yTq6EkBw0uHV7Z7dy74NRnN40iGb4iyZqGQE=;
X-YMail-OSG:
tFOlMmMVM1nLRyVUvls5ncKbsG.hG4kiK8UqEqc2znhcrSwhNuSWGC8rRDfj TFbKhQ--
Received: from [41.223.24.125] by web44901.mail.sp1.yahoo.com via
HTTP; Tue, 04 Dec 2007 04:06:25 PST

Okay, I will try this IP to see where it comes from. 41.223.24.125
Lookup Service: http://www.webyield.net/domainquery.html
IP Address: 41.223.24.125
Hostname: no reverse DNS for this IP
Try a country lookup: IP is not in database!
Query took 0 ms
Try a different lookup service. http://www.ip2location.com/free.asp
IP Address Country (Short) Country (Full) Flag Region
City ISP Map
41.223.24.125 NG NIGERIA - - AFRINIC
(The map feature is BS, just shows a global picture of the earth with
no location on it.) A much better lookup
service though. Much more thorough. Demo gives you 20 lookups a day,
full version

Date: Tue, 4 Dec 2007 04:06:25 -0800 (PST)
From: Tracey Jones
Subject: Re: Room for rent on myspace
To: Ohmster
In-Reply-To: <005801c835e8$2c55bb80$0300a8c0@MISSY>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="0-1624778928-1196769985=:38911"
Content-Transfer-Encoding: 8bit
Message-ID: <744193.38911.qm@web44901.mail.sp1.yahoo.com>

--0-1624778928-1196769985=:38911
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++
++++++

This is starting to sound a lot like those Nigerian money scams but
what is the angle, why bother someone with a room to rent?
Wow, this IP Service website even does email lookups, check this out!
http://www.ip2location.com/emailtracer.aspx

Oh wow, it worked! I pasted in all the headers for the Benin Republic
email and got back the email trail:

Sender (her)
Nigeria
New York
New York
UK London, England
US
Tawain
Receiver (me)

Wow, this is freaking *bitching* man! I am bookmarking the hell out of
this site and am going to subscribe.

Let's do the UK lady next...

Sender (her)
Nigeria
US California
US New York
US New York
US New York
US New Jersey
US New Jersey
Receiver (me)

Don't sound like any lady in the UK to me. So they are all fakes. Is
that how you see it Dave? I will watch for your reply to get your take
on all of this because it does matter. It looks like these assholes
have been wasting my time and running me around. What do you think?

Anyone else that has input on this header tracing is welcome to
participate. All replies welcome. Thank you very much.
--
~Ohmster | ohmster /a/t/ ohmster dot com
Put "messageforohmster" in message body
(That is Message Body, not Subject!)
to pass my spam filter.

Re: How to ID origin in email headers?

On Tue, 04 Dec 2007 18:59:18 -0800, Ohmster wrote:

> I have to post through google groups. For some reason, my real
> newsreader stalls on this followup and I have no idea of why.
>
> Dave Uhring wrote in news:
> 13lbf0bnthhrm31@news.supernews.com:
>
> Thank you for writing Dave. Hey, your reply did not word wrap for Usenet
> posting. That is pretty neat for stuff like this, how did you do it? Oh
> there is a word wrap option in Xnews, duh!

>> That one came from hotmail but was posted from 212.52.134.213, which
>> resolves to: not found. However, whois indicates that it came from
>> somewhere in Africa.
>>
>>
> Now I see how you did that and that was very good Dave. Thank you for
> the lesson. I am not sure what mail client you use or if it makes a
> difference or not. I think you said you recieced this on yahoo mail and
> that they have a "Full Headers" button that you can click to see all of
> the headers. I get my mail delivered to Outhouse Express and they have a
> similar feature, hold Control and press and release F3 to see the
> original contents of the raw mail, including all headers.

I use a browser, Firefox, to access yahoo mail. I have no knowledge of
those Windows products. For normal email I use mutt on either Linux,
Solaris or OpenBSD, and generally on the mail server which I admin.
[...]
> Anyone else that has input on this header tracing is welcome to
> participate. All replies welcome. Thank you very much.

Those web lookups for reverse DNS and whois make my brain hurt. I use
utilities which are universal in Linux, BSD and the various Unices.

Keep practicing your header analysis. It will come to you.

Re: How to ID origin in email headers?

Dave Uhring wrote in news:13lc7gr1aafkhd5
@news.supernews.com:

[..]
> I use a browser, Firefox, to access yahoo mail. I have no knowledge of
> those Windows products. For normal email I use mutt on either Linux,
> Solaris or OpenBSD, and generally on the mail server which I admin.
> [...]
>> Anyone else that has input on this header tracing is welcome to
>> participate. All replies welcome. Thank you very much.
>
> Those web lookups for reverse DNS and whois make my brain hurt. I use
> utilities which are universal in Linux, BSD and the various Unices.
>
> Keep practicing your header analysis. It will come to you.

Heh, I hear ya Dave. To tell the truth, I would like to have a job where I
could work on UNIX or Linux machines and networks. I do television repair
now and it is getting very hard to make a living doing this anymore. I have
been doing Linux as a hobby for over 10 years and really love it. It all
just "makes sense" because you can see what is going on, config files you
can read and edit, not like Windows where you get to see nothing under the
hood and just hope it all works, not to mention rebooting all the time.

The email header anylizer really does work so far as I can tell on where
email originates and shows all the paths it took to get here, that web page
is pretty darned amazing, you should try it at least once, just to see how
it works.
http://www.ip2location.com/emailtracer.aspx

Thanks for your help.

--
~Ohmster | ohmster /a/t/ ohmster dot com
Put "messageforohmster" in message body
(That is Message Body, not Subject!)
to pass my spam filter.

Re: How to ID origin in email headers?

On Wed, 05 Dec 2007 09:19:32 -0600, Ohmster wrote:

> The email header anylizer really does work so far as I can tell on where
> email originates and shows all the paths it took to get here, that web
> page is pretty darned amazing, you should try it at least once, just to
> see how it works.
> http://www.ip2location.com/emailtracer.aspx

I've spent a good part of the last 4 years reading email headers. You
wouldn't believe where some of the spam comes from - bots in huge corps
and not-for-profits, universities, you name it - winbloze and Linux
servers alike. Google, hotmail, yahoo, major ISPs - they are all spam
sewers.

Re: How to ID origin in email headers?

On Dec 6, 1:37 am, Dave Uhring wrote:
> On Wed, 05 Dec 2007 09:19:32 -0600, Ohmster wrote:
> > The email header anylizer really does work so far as I can tell on where
> > email originates and shows all the paths it took to get here, that web
> > page is pretty darned amazing, you should try it at least once, just to
> > see how it works.
> >http://www.ip2location.com/emailtracer.aspx
>
> I've spent a good part of the last 4 years reading email headers. You
> wouldn't believe where some of the spam comes from - bots in huge corps
> and not-for-profits, universities, you name it - winbloze and Linux
> servers alike. Google, hotmail, yahoo, major ISPs - they are all spam
> sewers.

You might also like to try this Spam Locator:
http://www.geobytes.com/SpamLocator.htm

Re: How to ID origin in email headers?

On Wed, 05 Dec 2007 19:41:49 -0800, kaelene wrote:

> You might also like to try this Spam Locator:
> http://www.geobytes.com/SpamLocator.htm

Why would I use some web-based whois tool which failed to get even my
location correct? That useless POS did not even attempt to identify the
ISP which I use. And I really doubt that my national currency of the US
Dollar has anything in common with the spam problem.

Re: How to ID origin in email headers?

kaelene@gmail.com wrote in news:7a88bfad-7530-4953-8133-dc9552d926d1
@b40g2000prf.googlegroups.com:

>> I've spent a good part of the last 4 years reading email headers. You
>> wouldn't believe where some of the spam comes from - bots in huge corps
>> and not-for-profits, universities, you name it - winbloze and Linux
>> servers alike. Google, hotmail, yahoo, major ISPs - they are all spam
>> sewers.
>
> You might also like to try this Spam Locator:
> http://www.geobytes.com/SpamLocator.htm
>

I did try the above service but it did not seem to work so good. I tried it
along with the other one. This one did not get the country of origin
correct, in the case of the headers I supplied here, 1st entry, they cannot
even identify the IP origin, but the ip2location site did not have any
problem with it, Nigeria.
http://www.ip2location.com/emailtracer.aspx

Here are the actual headers:
http://www.ohmster.com/~ohmster/email/

The IP address, 82.128.14.128, could not be identified by geobytes at all
but most other IP Locaters got it pegged as Nigeria. That one does not seem
to work so good. I got a check today for a room deposit from this "UK
Lady" that was like $3,000 too much money. I took the check to Wachovia
because it was a Wachovia check and I have such and account and asked them
to check it for me. Complete fake, check fraud. Good thing I did not try to
deposit it.


--
~Ohmster | ohmster /a/t/ ohmster dot com
Put "messageforohmster" in message body
(That is Message Body, not Subject!)
to pass my spam filter.