Tools To Trace an Email - Comments Page 1

I use a simple approach to emails - "when in doubt, wipe it out". I do lose the very occasional legitimate email, but it does reduce the risk of accidentally opening a malware message.

You suggest we delete this type of email. I mark them as spam...is this the incorrect thing to do?

And I always check the header of any email that looks funky before deciding whether to open.

This is a very interesting article regarding just how much info is available in the header.

What I have been doing is hit the CTRL-U which will bring up the source text file of the email in a new window. (You don't really have to even open an email to do this.)

Then I copy the IP address of the origination into a WhoIS lookup.

While I'm doing it, any links given in the email can also be run thru the WhoIS to see where they are located.

You recommend MyTurboPC's Windows Registry Cleaner©. But a check on Google shows many sites that say it is a SCAM. (https://www.stopscamware.com/registry-scam-myturbopc). Please explain.

Bob doesn't put the ads there. They are not recommended by him.

I am always interested in some of the weird emails I receive. WHOIS (I see Bob K mentions it above) and ARIN are also some tools to help trace the message. I forget how I did it, but a few years ago I was able, after quite some work, to find out the city in China where the bogus email came from. Wish I could remember what I did!

My curiousness always gets the better of me.

I started receiving this type of email after applying for Canada Pension Plan. Now retired I don't have the assets to hunt these parasites down.

Two comments:

1. I found that
http://www.iptrackeronline.com/email-header-analysis.php
gets better reviews than MXToolbox.

2. I forward all my Spam to Knujon where they go after the spammers in every way possible.
http://www.knujon.com/

Hi Bob, for what it's worth, and as an exercise, I used Email Header Analyzer to check up on your email header. I'm not technically savvy on the information provided, but did notice that one entry on a "From" line, smtp-coi-g04-011.aweber.com was tagged as BlackList.

You say ot to reply to any spam, even to ask them to delete your name because that will show them ou are a valid address.
I once started to get a whole lot of email with the from line having weird-sounding names, promising sex dates and such. A dozen or more a day, same apparent source. They always had a message that says if you do not want to receive our emails, please let us know and we'll stop it.
I thought, what the hell, they already know my email is valid as the emails do not get bounced back. So I asked them to delete me.
Believe it or not, they did. Never heard from them again.
Some things work.
By the way, what happens if you try to take them up on it? Do they try to sell you sex pics? Do you get trapped on a botnet? Sex with 72 virgins? I guess I'll never find out.

Some replies imply that it can be dangerous to even open a suspect email. Is this true? I thought the thing to avoid was clicking on a link contained in such an email, or opening an attachment. Can simply opening an email cause any problems?

I use a program called Mail Washer.It lets me see the headers also I can read the body of the mail, as it don't down load from my server until I process the mail. I then can bounce it from my server,I very seldom receive more then two before it stops.Thanks for all the good advice I have received from you.

I use Spamcop to report spam emails to the necessary abuse contacts

Good information... and very good responses and suggested sites. I get some 50 to 100 spams a day as I have had a gmail account for over 10 years with the same address. Gmail does very well at sorting them into the Spam Folder. What I would like to know is HOW you can trace an email that you SEND. I have a couple people that always say, "But your mail never arrived", yet, it is NOT bounced or returned as undeliverable. I suspect that the people really got the mail but are ducking the responsibility. How can I trace email that I send and doesn't bounce back to me?

Don't forget one spam that aims at your heart: A relative or friend sends you a desperate email saying that he or she has been (1) wrongly thrown in jail, (2) robbed of his/her money, etc., and always needs a loan, which you should send to a temporary email address. Grandparents don't always know their grandchildren's whereabouts yet feel responsible for them, thus are ideal targets.

Moral: Before transfering a dime, check the sender by phone. Chances are the person's still in the U.S. and has an email account that's been hacked.

Good information Bob; generated a lot of good information for novices.

Re: Bob K
I don't know what e-mail client you use, but Ctrl+U brings up the page source code rather than that for the e-mail in at least two clients. I get the header by right-clicking the subject line and selecting to view the source code.

Re: Art
So far just opening a plain text message has been safe. However, most are in HTML format and could contain extra code that transmits to an unsavory source - leading to more SPAM or even downloading malware.

I have found a very useful add-on for Thunderbird called MailHops 1.0.12 by Andrew Van Tassel. It will list each of the hops taken and it will show a map of the path and distance travelled of the message. So if I get a message from Uncle Lou asking me to click on a url I will enjoy and I see the message originated in Lithuania, I can safely delete it.

Hi Bob, good article as always. I can use your help. I use outlook.com as my e-mail program, lately I have been getting some e-mails, that when I go to block them, my e-mail address shows up instead of the person who sent the e-mail. In other words to me from me. I sent a copy to the FTC as you recommended. It's not private mail it's some sort of scam as usual, I have been deleting them off, as I'm afraid to open them. Any comments would be appreciated !

Re: Old Man
On the CTRL-U -- I guess I should have explained it a little better. You are right in that it brings up the source page for whatever you are viewing (maybe).

I use Thunderboid for an email client. With that, if you have an email open, it shows the source. Also, if you just highlight one entry in the inbox, without opening it, it will show the source of that email.

If you are using a web-based email client, many of them have the ability to show source also, or at least all the headers.

Re: Olamoree
On the lost emails you send -- many ISPs check outbound emails for what they consider malware, or whatever, and silently drop it. Example: I receive an email that is supposed to be from my bank but isn't, and I want to forward it to the security people at my bank. Never gets to them!

I always do a BCC: back to myself on every email I send. Sometimes my ISP was eating things for no reasonable reason. My outbound email no longer goes thru my ISP. The Gmail servers seem to work fine for me, there are probably others out there that are also just as good.