How to Trace the Origins of an Email
In most cases, discovering the origin of an email is simply a matter of looking at the domain in the "From" field on the message. The domain follows the "@" symbol in the email address and often ends with ".com," ".net" or a similar suffix. However, this method is not always trustworthy because the return address can be easily faked. Every email message contains a history of its journey across the Internet in the message "header." While even header fields can be manipulated, one piece of information will tell you the true origin of any email -- the originating Internet Protocol (IP) address.
Other People Are Reading
Instructions
-
-
1
Open the email in question and examine the message header. The procedure for doing this depends on the service you use to view your email. In Gmail, you would click the arrow beside the "Reply" button and select "Show original." In Yahoo! Mail, click on the "Actions" button and select "View Full Header." In Hotmail, click on the arrow beside the "Reply" button, then select "View message source." In Microsoft Outlook, click on "Options..." under the "View" menu and then select the "Internet Headers" box.
-
2
Inspect the information in the message header. You will see one or more lines beginning with "Received from." These are displayed in reverse chronological order, showing a history of the servers the message passed through as it traveled from the sender's computer to yours.
-
-
3
Find the last "Received from" line. This reveals the originating IP address for the message. The IP address is a series of four numbers, each number being one to three digits long, separated by periods.
-
4
Copy the IP address on the last "Received from" line by highlighting it and then pressing "Ctrl" + "C" on your keyboard.
-
5
Open a Web browser. You can paste the IP address directly into a search engine such as Google using "Ctrl" + "V" on your keyboard. This will often produce a list of IP tracking services that can provide information on the IP address in question. Another option is to navigate to an IP address tracking service such as IP2Location or GeoBytes, and once there, paste the IP address into the search field.
-
6
Read the information the IP tracking service has on the IP address. In most cases, it will reveal the country and city where the message originated as well as the name of the Internet service provider used.
-
1
Tips & Warnings
If you are certain the domain name used in the email address is genuine, you can use an online "WHOIS" database to obtain information about the person or company listed as the owner of that domain. This information often includes a mailing address and telephone number.
