Tracing IP address from emails

Posted by ADMINISTRATOR On 30 June 2009 No Commented

fbshare

IP Address Tracking Program

This program performs an IP address lookup and finds the ISP and country of origin

You get abusive mails from somebody and want to know where it has come from!
Someone mails you claiming to be from one place and you suspect that he or she is from another place
You just want to track an email you received
You want to trace an IP address or do an IP address lookup out of curiosity

Log into your Gmail account with your username and password.
Open the mail.
To display the email headers,
- Click on the inverted triangle beside Reply. Select Show Orginal.
You may copy the headers and use the IP address detection script to ease the process. Or if you want to manually find the IP address, proceed to 5.
Look for Received: from followed by the IP address between square brackets [ ].
```
Received: from [69.138.30.1] by web31804.mail.mud.yahoo.com
```
If you find more than one Received: from patterns, select the last one.
Track the IP address of the sender(description at the top)

Log into your Yahoo! mail with your username and password.
Click on Inbox or whichever folder you have stored your mail.
Open the mail.
If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
- Click on Options on the top-right corner
- In the Mail Options page, click on General Preferences
- Scroll down to Messages where you have the Headers option
- Make sure that Show all headers on incoming messages is selected
- Click on the Save button
- Go back to the mails and open that mail
You should see similar headers like this:
You may copy the headers and use the IP address detection script to ease the process. Or if you want to manually find the IP address, proceed to 7.
Look for Received: from followed by the IP address between square brackets [ ]. Here, it is 202.65.138.109.
That is be the IP address of the sender.
If there are many instances of Received: from with the IP address, select the IP address in the last pattern. If there are no instances of Received: from with the IP address, select the first IP address in X-Originating-IP.
Track the IP address of the sender

Log into your Hotmail account with your username and password.
Click on the Mail tab on the top.
Open the mail.
If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
- Click on Options on the top-right corner
- In the Mail Options page, click on Mail Display Settings
- In Message Headers, make sure Advanced option is checked
- Click on Ok button
- Go back to the mails and open that mail
You sh
ould see the email headers now.
You may copy the headers and use the IP address detection script to ease the process. Or if you want to manually find the IP address, proceed to 7.
If you find a header with X-Originating-IP: followed by an IP address, that is the sender’s IP address
In this case the IP address of the sender is [68.34.60.59]. Jump to step 9.
If you find a header with Received: from followed by a Gmail proxy like this

Look for Received: from followed by IP address within square brackets[].
In this case, the IP address of the sender is [69.140.7.58]. Jump to step 9.
Or else if you have headers like this

Look for Received: from followed by IP address within square brackets[].
In this case, the IP address of the sender is [61.83.145.129] (Spam mail). Jump to step 9.
* If you have multiple Received: from headers, eliminate the ones that have proxy.anyknownserver.com.
Track the IP address of the sender

I wrote a Perl script to automate this task for you. All you have to do is select your email service and copy your email headers in the box below.

You may do one of the following:

You can copy all the headers from your email and paste them here.
In this case, the unnecessary headers (like Subject:) will be removed automatically.
You can remove all headers except those beginning with
- X-Originating-IP:
- Received: