How do you trace an email?

[Krishno22]

As a school teacher I always warn my students that whatever they send by email can be traced back to them (I know that isn't absolutely true but that is what I tell my 7th and 8th graders)

Recently one of my students has been receiving hate mail. Both accounts are MSN Hotmail. Is there anyway I can get info on who the person sending the email is?

Thanks

[golfcart]

My favorite way is with a program called sam spade. you can download it here (http://www.samspade.org/) . http://www.sysopt.com/forum/smile.gif

[Dave_H]

The information you really need is the senders IP address and the time the message was sent. With this information, the senders ISP can trace the account to who it belongs to and the authorities can get involved.

To find the IP address in a hotmail message depends on how the student is viewing the message. If it is being accessed thru hotmail, you need to go to:
Options\Preferances, and change the setting "Message headers" to full or advanced.

If the message is being viewed thru Outlook Express, open up the message and go to:
File\Properties\detail


Edit- I thought I should edit my post.
I first suggested that Krishno22 post the IP address and we could give her/him all the neccessary information. Although I have seen IP addresses posted for similar situations here, I unsure if I should suggest it.
My E-mail address is in my profile Krishno22, if you need any help in this matter. -end edit
Best of luck,
Dave


[This message has been edited by Dave_H (edited 05-08-2001).]

[Krishno22]

Thanks for the information. Now I need to run the idea by my Vice Principal. I'm just interested in seeing how it works.

I'll keep you updated.

[MadMatt]

Good tips, Dave_H. Unfortunately, the headers of Hotmail-Hotmail messages are very sparse on info:

X-Originating-IP: [199.228.142.2]
Received: from 199.228.142.2 by pv1fd.pav1.hotmail.msn.com with HTTP;Wed, 09 May 2001 16:38:55 GMT

That IP is not the IP of the originator. I'm not positive (it's very well hidden behind a firewall), but I think it is the originating hotmail server. Still, this message was sent through the web site. You might get more info if it's sent through OE.

Here's something from the Hotmail help file:

To report e-mail containing harassment, threats, vulgarity, or pornography, forward an unedited copy of the offending e-mail to abuse@hotmail.com. Any materials or files that the e-mail contained should still be attached.

[MadMatt]

LOL! Actually, it is one of our proxies - I made an *asumption* because it was not my workstation IP. Shoulda done a whois on it. Good catch Dave!

Jadison - you can find out if it's behind a firewall by typing the address into your browser. You should get prompted for a firewall password.

[Dave_H]

Actually MadMax, the originating IP is the IP address of the computer sending the message. (Unless it was sent thru a proxy or otherwise disguised, spammers are getting quite good at that). Running it thru a trace utility will give you information on the persons ISP who sent the message. The ISP should be able to track who owns the account if given the IP address, and time the message was sent.

Your right that IP you posted is behind a firewall, but that doesn't matter because you don't have to get to the actual computer. For instance, that address will yield the following contact information:

EDS Network Naming and Addressing Management (NNAM) (NETBLK-GM-EDS-CBLK4)
800 Tower Drive Mail Stop- 4126
P. O. Box 7019
Troy, MI 48007-7019
US

Netname: GM-EDS-CBLK4
Netblock: 199.228.0.0 - 199.228.255.255
Maintainer: EDS

Coordinator:
Cross, Janis (JC2418-ARIN) JCROSS02@NOVELL.TRTS01.EDS.COM
810-265-4550

Domain System inverse mapping provided by:

NS1.EDS.COM 192.85.154.78
DNS1.AGT.GMEDS.COM 139.73.4.4
NS2.EDS.COM 199.228.142.78

Record last updated on 11-Jul-1996.
Database last updated on 8-May-2001 23:19:37 EDT.

----------

IS/IE (NET-GM-EDS-F-142)
5200 LEGACY DR
PLANO, TX 75024
US

Netname: GM-EDS-F-142
Netblock: 199.228.142.0 - 199.228.142.255

Coordinator:
Tobiason, Richard (RT106-ARIN) rtobia01@NNAM.EDS.COM
(810) 265-4525

Record last updated on 26-Dec-1995.
Database last updated on 8-May-2001 23:19:37 EDT.

Here is what I use if I need to trace something, it's a freebie called "Network Tracer". <A HREF="http://www.pc-help.org/trace.htm" TARGET=_blank>http://www.pc-help.org/trace.htm</A>

Great tip about the hotmail abuse department, but keep in mind that they are not the ISP, just a free E-Mail service.
Dave



[This message has been edited by Dave_H (edited 05-09-2001).]

[jadison]

WOW,
(A) How did u know that that IP address was from behind a firewall?
(B)Dave...was all that information provided by that utility?

Thanks for the tips, I'll try them out!

-=jd=-