Tracing an by Etienne Takougang by Etienne Takougang

Introduction Do you hate Spam? Of course, we all do! Have you ever wondered just who was hiding behind those anonymous s that keep finding their way into your Inbox? Well, this manual will help you detect and identify the origin of these anonymous s. The most convenient way of achieving this goal is to use the program TrackerPro. A free trial version is available at Do you hate Spam? Of course, we all do! Have you ever wondered just who was hiding behind those anonymous s that keep finding their way into your Inbox? Well, this manual will help you detect and identify the origin of these anonymous s. The most convenient way of achieving this goal is to use the program TrackerPro. A free trial version is available at

The first step is to use an analysis tool like TrackerPro, which will automatically analyze an and its headers and provide graphical results similar to the following: Using TrackerPro

n If you do not have an actual , but only have an address, you can use the Tracker tool in VisualRoute to track the user to their server. n An added benefit is that you are able to see what SMTP software the mail server is running (many times with version information as well). n In most cases, using an tracking tool like TrackerPro is your best option. But, if you want to understand how these tracking tools work, continue reading...

Internet Headers Every received has Internet Headers. Using Microsoft Outlook as an example (other mail programs are very similar), just follow these steps to view the headers: Every received has Internet Headers. Using Microsoft Outlook as an example (other mail programs are very similar), just follow these steps to view the headers: n

n 1. Right-click on the mail message that is still in your Outlook that is still in your Outlook Inbox Inbox n 2. Select 'Options...' from the resulting popup menu resulting popup menu n 3. Examine the 'Internet Headers’ in the resulting ‘Message in the resulting ‘Message Options’ dialog box Options’ dialog box

When your full header is not visible on your n Some programs like Hotmail or Yahoo have their full headers hidden by default. n In order to view the full header, you must specifically turn on that option.

Yahoo n 1. Click Options n 2. Click Mail Preferences n 3. Click “Show Headers” n 4. Click “All” n 5. Click Save

Hotmail n 1. Click Options n 2. Click Mail Display Headings (under “Additional Options”) “Additional Options”) n 3. Click “Message Headers” n 4. Click “Full” n 5. Click OK

Example Example What you see when you view the message headers will be very similar to the following:

1: Received: from tes1a623.On .com.sg ([ ]) 1: Received: from tes1a623.On .com.sg ([ ]) by visualroute.com (8.11.6) id f9CIVSk24480; Fri, 12 Oct by visualroute.com (8.11.6) id f9CIVSk24480; Fri, 12 Oct :31: (MDT) :31: (MDT) 2: Message- 2: Message- Id: Id: 3: Received: from drb.com (IIM1608 [ ]) by 3: Received: from drb.com (IIM1608 [ ]) by tes1a623.On .com.sg with SMTP (Microsoft Exchange tes1a623.On .com.sg with SMTP (Microsoft Exchange Internet Mail Service Version ) Internet Mail Service Version ) 4: id 4XNK9ATR; Sat, 13 Oct :19: : id 4XNK9ATR; Sat, 13 Oct :19: : From: 5: From: 6: To: <> 6: To: <> 7: Subject: Long Distance cents per min - NO FEES! 7: Subject: Long Distance cents per min - NO FEES! 8: Date: Fri, 12 Oct :24: : Date: Fri, 12 Oct :24: : X-Sender: 9: X-Sender: 10: X-Mailer: QUALCOMM Windows Eudora Pro Version : X-Mailer: QUALCOMM Windows Eudora Pro Version : Content-Type: text/plain; charset="us-ascii" 11: Content-Type: text/plain; charset="us-ascii" 12: X-Priority: 3 12: X-Priority: 3 13: X-MSMail-Priority: Normal 13: X-MSMail-Priority: Normal 14: X-UIDL: 8`Y!!0GR!!"?H"!k:O!! 14: X-UIDL: 8`Y!!0GR!!"?H"!k:O!! 15: Status: U 15: Status: U

‘Received’ Header The most important header field for tracking purposes is the Received header field, which usually has a syntax similar to: The most important header field for tracking purposes is the Received header field, which usually has a syntax similar to: Received: Received: from ? by ? via ? with ? id ? id ? for ? date-time

Sender’s IP Address What is crucial for tracking, is to pay attention to the trail of IP-address in the from tokens and not necessarily the host name provided to us in the by tokens: What is crucial for tracking, is to pay attention to the trail of IP-address in the from tokens and not necessarily the host name provided to us in the by tokens: Received: Received: n from tes1a623.On .com.sg ([ ]) n by visualroute.com (8.11.6) n id f9CIVSk24480; n Fri, 12 Oct :31: (MDT)

Track the IP Address n Use TrackerPro to track the IP Address! Track down the person! The resulting trace will look somewhat like the following generic trace:

Conclusion As a result, by using TrackerPro and analyzing message headers, you are fully capable of tracing that mysterious . You can now take action and rest easy. As a result, by using TrackerPro and analyzing message headers, you are fully capable of tracing that mysterious . You can now take action and rest easy.

Merry Christmas and Happy New Year! Merry Christmas and Happy New Year!

THE END