Email Trace 1

[WearyOne]

I understand that within email properties the machine that initially sent the email is the bottom most "received" information. If someone can link to another computer via GoToMyPC, or some such program, and send an email through that computer's email software, will there be any indication in the properties that this has happened, or will the email look as if it's come from the computer that has been linked to?

Thanx

 

[mrdenny]

No using FoToMyPC or VNC, or PC Anywhere, or Terminal Services will not effect the headers of a sent email.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(My very old site)

 

[WearyOne]

Thanks Denny. That's what I thought. I'm trying to determine (for personal reasons) if two separate emails came from the same computer. They are from different days, but the bottom most "received" information lists the exact same IP address. Logging in from a remote computer would explain that I guess... Is there any other identifying information in the properties that may reveal that?

Thanx

 

[mrdenny]

Nope, it's not going to say anywhere in the email is the person was at the console, or connected remotly in some way.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(My very old site)

 

[eyec]

if you have access to one of the two suspect machines you can check the time stamps for either remote access or actual time of sent emails.

 

[itcontractor]

agree. have a look in the event viewer for remote connections to the machine.

 

[lullysing]

I work abuse@some.isp so perhaps i can give you some help.

first of all, you need to obtain the complete headers of the email. there are several clues that will help you locate the originating system, but those require experience and practice in tracking mail. Also know that spammers are notorious for trying ( rather badly might i say) to add "fake headers" to confuse the hell out of tracker programs.

Just locate the reception point, and follow the mail ( check dates and times. they help).
EX : Received by X from Y. Received by Y from z. Received from Z from D. Received by c from b.

In this case for example, originating point might be from D. Also check the MESSAGEID field, since you're probably gonna get something like "Q!@@#$!BHSYHXZJAnHXC7612r761235457@system". Also, careful with hostnames, since spammer machines are notorious for adopting an "ip address-like" hostname that does not reflect the real IP it is connected to ( all the more to ofuscate their track).





_____________________________
when someone asks for your username and password, and much *clickely clickely* is happening in the background, know enough that you should be worried.