Finding out who sent the fake email.

[lushlad]

Hi, I have not checked if this has been posted before or even if it widly known to people on how to show the email's source but here it goes.

Im hotmail web based email click on the email right click, then click view message source. This will show you somthing like the following:

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtTQ0w9NA==
X-Message-Status: n:0
X-SID-PRA: Blizzard Entertainment <[email protected]>
X-AUTH-Result: NONE
X-Message-Info: 6sSXyD95QpWZ2cOfGY5KTB1FkOrudPu54jb0ATeQKMEVMcprgaOkZZ04f6Fb4AX9e1CSp4G7W+4b86HN8HMar0vwgofx9Wt3
Received: from blu0-omc4-s29.blu0.hotmail.com ([65.55.111.168]) by bay0-hmmc1-f6.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 5 Mar 2010 18:44:15 -0800
Received: from BLU0-SMTP82 ([65.55.111.135]) by blu0-omc4-s29.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 5 Mar 2010 18:44:15 -0800
X-Originating-IP: [64.140.182.11]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Return-Path: [email protected]
Received: from grztkulbk ([64.140.182.11]) by BLU0-SMTP82.blu0.hotmail.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959);
Fri, 5 Mar 2010 18:44:13 -0800
From: "Blizzard Entertainment" <[email protected]>
To: <**************@hotmail.co.uk>
Subject: World of Warcraft Account Management
Date: Sat, 6 Mar 2010 10:33:55 +0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: base64

As you can see thats alot of information but we are looking for two lines....

Return-Path: [email protected]
X-Originating-Email: [[email protected]]

As you can see it clearly shows the REAL email adress it was sent from aswell as the return email if would go back to if you was to reply.

I know this if not the persons name and address but you could always get a small bit of revenge with a mail client

BTW the email listed is from a email I got this morning feel free to add it to your block list.

This SHOULD work with other email providers/software that has the view scource option.

[Woodlauncher]

If you look right above the X-Originating-Email you'll also see the senders IP, so you can actually get his adress. I can't, but some people can. X-Originating-IP is easy to fake, but how many of the morons who uses that scam aren't too retarded (yes, retarded, not smart, because you dont ****ing have to be smart to do it) to do that?

Luckily i'm from Sweden and use Telia as my ISP and they don't keep information about who had what IP for more than 3 days, so they better be quick or they won't get anything.

[Faulen]

On Yahoo go to:

Actions,
View Full Header
then get,

Return-Path: <[email protected]> or whoever the Email was sent from around the 4th line.

[susy]

Gave you 3 rep

[Matt]

At least once a week I get one of these mails.. and I'm like goddamnit, don't these newbs know i created mmowned and pretty much taught whoever taught them how to send those friggin mails out.. so my revenge is usually figuring a way into their phishing page and stealing their stolen accounts. be careful who you try to phish..

[TechnoKilla]

Could some1 tell me what I could do with one of these people's I.P's for punishment?

[Serae]

Is it possible to do this on Gmail?

[pallydmg]

add better email secruity add better headers so you can see where it came from wat ip,

looks like it did come straight off a hotmail server i would just send it to abuse% or go to domaintools.com and checkout the network whois for them ips and post that to them and wat the email contents are

[omgcool7]

haha niceee

[majinbuu1023]

---------------------------

[lushlad]

Could some1 tell me what I could do with one of these people's I.P's for punishment?

For the Email addy you could bomb it (Google: mail bomb). as for the IP it depends if it dyamic (changes all the time) or static, even then you would need a way into there computer via a backdoor, portscan? plenty of information on this out there just use google

[treeko11]

Is it possible to do this on Gmail?

Yes, it is.

Go to the top right hand where it has a little arrow pointing down, and click "Show Original"

Easymode.

[lolrogue]

this is stupid because the real person is the guy who runs the botnet not the infected ******s

use your brain

[lushlad]

this is stupid because the real person is the guy who runs the botnet not the infected ******s

use your brain

What are you on about?!

[Xel]

Stealing scammed accounts from scammers is ironic.