E-mail header experts, where is this mail from? - GoFuckYourself.com

kmanrox · 05-24-2006, 04:17 AM

The only legible IP address I can get is from Pakistan, but this person is supposedly in Africa (no, not a scam or for business lol!)... Can anyone help me find out where it truly came from? Is it possible that Yahoo is using their Pakistani server or something? What is that IP number, the IP where the person truly is sending the mail from?

Any help would be great:

X-Gmail-Received: 733661906dc453d3050f3d63a45516540687dc50
Delivered-To: @gmail.com
Received: by 10.35.129.20 with SMTP id g20cs578859pyn;
Tue, 23 May 2006 11:48:58 -0700 (PDT)
Received: by 10.70.60.6 with SMTP id i6mr6719532wxa;
Tue, 23 May 2006 11:48:57 -0700 (PDT)
Return-Path: <[email protected]>
Received: from web35905.mail.mud.yahoo.com (web35905.mail.mud.yahoo.com [66.163.179.189])
by mx.gmail.com with SMTP id h14si5619979wxd.2006.05.23.11.48.57;
Tue, 23 May 2006 11:48:57 -0700 (PDT)
Received-SPF: pass (gmail.com: domain of [email protected] designates 66.163.179.189 as permitted sender)
DomainKey-Status: good (test mode)
Received: (qmail 99347 invoked by uid 60001); 23 May 2006 18:48:56 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding;
b=vUCS6O1jZ9o+kf1Zf0zTBhGjOH/aLxMlk05GkMRVuj5OODN5J1eYg+61j9D2P41oP4Ej4EC3VUOjt co7j+hDaJzgehvOftqWegh/V7tG+m2LPaLcj+iv9Slnr7ancFG101E= ;
Message-ID: <[email protected] o.com>
Received: from [80.87.84.30] by web35905.mail.mud.yahoo.com via HTTP; Tue, 23 May 2006 11:48:56 PDT
Date: Tue, 23 May 2006 11:48:56 -0700 (PDT)
From: TRACY WILLIAMS <[email protected]>
Subject: Thanks.
To: Admin <@gmail.com>
In-Reply-To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-683701543-1148410136=:97164"
Content-Transfer-Encoding: 8bit

--0-683701543-1148410136=:97164
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

Juicy D. Links · 05-24-2006, 04:28 AM

sec let me analoyze

kmanrox · 05-24-2006, 04:29 AM

hmm actually that IP says from the US... damn.. any other ideas?

Chio The Pirate · 05-24-2006, 04:37 AM

looks like that one 80.87.84.30

Chio The Pirate · 05-24-2006, 04:39 AM

I'm much better with usenet headers

fris · 05-24-2006, 05:01 AM

ip is from ghana (gh)

Information related to '80.87.80.0 - 80.87.87.255'

inetnum: 80.87.80.0 - 80.87.87.255
netname: ghanatel
descr: Ghana Telecom ADSL ADDRESS POOL
country: GH

Screaming · 05-24-2006, 05:46 AM

no clue....

s9ann0 · 05-24-2006, 06:11 AM

I make it 80.87.84.30 - Ghana i tried to ping its down so I doubt its a proxy

some nigerians trying to scam u?

justsexxx · 05-24-2006, 06:11 AM

Is it send to your yahoo account?

Received: from [80.87.84.30] Unless it's spoofer this is the IP address...And that one looks like to be fron Ghana(as posted above) And Ghana is somewhere in Africa(like it should like you said)

Good luck with helping the king of oekibaki, and receiving your 100.000 reward for sending just 30.000USD (j/k)

Andre

rowan · 05-24-2006, 06:18 AM

In general you cannot trust SMTP headers, apart from the ones that the receiving system creates (assuming you do trust that

)

This means that the only IP which is pretty much guaranteed to be accurate is the one that your server marks as delivering the mail. Anything else, including lines like

Received: from [80.87.84.30] by web35905.mail.mud.yahoo.com via HTTP; Tue, 23 May 2006 11:48:56 PDT

... can be forged.

Nathan · 05-24-2006, 06:23 AM

gmail said it received from a yahoo.com server. The yahoo.com is SHA Authed, so its probably genuine.

Which would mean that the
Received: from [80.87.84.30] by web35905.mail.mud.yahoo.com via HTTP; Tue, 23 May 2006 11:48:56 PDT
Header is genuine too because it was made by yahoo.

So the mail account most likely is [email protected] and actually owned by the person that sent the mail, which was definately sent from 80.87.84.30 in that case.

Your Mothers Secret · 05-24-2006, 07:35 AM

so now you can drive right over to 80.87.84.30 and call him a name

kmanrox · 05-24-2006, 10:28 AM

well that would make sense, the person has told me they're from Ghana... so that checks out... thx guys =)

05-24-2006, 04:17 AM	#1
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,292	E-mail header experts, where is this mail from? The only legible IP address I can get is from Pakistan, but this person is supposedly in Africa (no, not a scam or for business lol!)... Can anyone help me find out where it truly came from? Is it possible that Yahoo is using their Pakistani server or something? What is that IP number, the IP where the person truly is sending the mail from? Any help would be great: X-Gmail-Received: 733661906dc453d3050f3d63a45516540687dc50 Delivered-To: @gmail.com Received: by 10.35.129.20 with SMTP id g20cs578859pyn; Tue, 23 May 2006 11:48:58 -0700 (PDT) Received: by 10.70.60.6 with SMTP id i6mr6719532wxa; Tue, 23 May 2006 11:48:57 -0700 (PDT) Return-Path: <[email protected]> Received: from web35905.mail.mud.yahoo.com (web35905.mail.mud.yahoo.com [66.163.179.189]) by mx.gmail.com with SMTP id h14si5619979wxd.2006.05.23.11.48.57; Tue, 23 May 2006 11:48:57 -0700 (PDT) Received-SPF: pass (gmail.com: domain of [email protected] designates 66.163.179.189 as permitted sender) DomainKey-Status: good (test mode) Received: (qmail 99347 invoked by uid 60001); 23 May 2006 18:48:56 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=vUCS6O1jZ9o+kf1Zf0zTBhGjOH/aLxMlk05GkMRVuj5OODN5J1eYg+61j9D2P41oP4Ej4EC3VUOjt co7j+hDaJzgehvOftqWegh/V7tG+m2LPaLcj+iv9Slnr7ancFG101E= ; Message-ID: <[email protected] o.com> Received: from [80.87.84.30] by web35905.mail.mud.yahoo.com via HTTP; Tue, 23 May 2006 11:48:56 PDT Date: Tue, 23 May 2006 11:48:56 -0700 (PDT) From: TRACY WILLIAMS <[email protected]> Subject: Thanks. To: Admin <@gmail.com> In-Reply-To: <[email protected]> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-683701543-1148410136=:97164" Content-Transfer-Encoding: 8bit --0-683701543-1148410136=:97164 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit

05-24-2006, 04:37 AM	#4
Chio The Pirate Confirmed User Join Date: Oct 2002 Location: YARGH! On me big sailboat with the skull flags * * ICQ: 39-183769 Posts: 946	looks like that one 80.87.84.30 __________________ Need to get a site indexed in a few days? Want thousands of targeted, quality hits to your site? Want to beta test something that will revolutionize the way companies, and individuals advertise online.? Click here to take a look at Bliggo

05-24-2006, 04:39 AM	#5
Chio The Pirate Confirmed User Join Date: Oct 2002 Location: YARGH! On me big sailboat with the skull flags * * ICQ: 39-183769 Posts: 946	I'm much better with usenet headers __________________ Need to get a site indexed in a few days? Want thousands of targeted, quality hits to your site? Want to beta test something that will revolutionize the way companies, and individuals advertise online.? Click here to take a look at Bliggo

05-24-2006, 05:01 AM	#6
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,372	ip is from ghana (gh) Information related to '80.87.80.0 - 80.87.87.255' inetnum: 80.87.80.0 - 80.87.87.255 netname: ghanatel descr: Ghana Telecom ADSL ADDRESS POOL country: GH __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

05-24-2006, 05:46 AM	#7
Screaming I can change this!!!!! Join Date: Feb 2004 Posts: 18,972	no clue.... __________________

05-24-2006, 04:28 AM	#2
Juicy D. Links So Fucking Banned Industry Role: Join Date: Apr 2001 Location: N.Y. -Long Island -- Posts: 122,992	sec let me analoyze

05-24-2006, 04:29 AM	#3
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,292	hmm actually that IP says from the US... damn.. any other ideas?

05-24-2006, 06:11 AM	#8
s9ann0 Confirmed User Join Date: Sep 2001 Location: Boston Posts: 4,873	I make it 80.87.84.30 - Ghana i tried to ping its down so I doubt its a proxy some nigerians trying to scam u?

05-24-2006, 06:11 AM	#9
justsexxx Too lazy to set a custom title Join Date: Aug 2001 Location: The Netherlands Posts: 13,723	Is it send to your yahoo account? Received: from [80.87.84.30] Unless it's spoofer this is the IP address...And that one looks like to be fron Ghana(as posted above) And Ghana is somewhere in Africa(like it should like you said) Good luck with helping the king of oekibaki, and receiving your 100.000 reward for sending just 30.000USD (j/k) Andre __________________ Questions? ICQ: 125184542

05-24-2006, 06:18 AM	#10
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	In general you cannot trust SMTP headers, apart from the ones that the receiving system creates (assuming you do trust that ) This means that the only IP which is pretty much guaranteed to be accurate is the one that your server marks as delivering the mail. Anything else, including lines like Received: from [80.87.84.30] by web35905.mail.mud.yahoo.com via HTTP; Tue, 23 May 2006 11:48:56 PDT ... can be forged.

05-24-2006, 06:23 AM	#11
Nathan Confirmed User Industry Role: Join Date: Jul 2003 Posts: 3,108	gmail said it received from a yahoo.com server. The yahoo.com is SHA Authed, so its probably genuine. Which would mean that the Received: from [80.87.84.30] by web35905.mail.mud.yahoo.com via HTTP; Tue, 23 May 2006 11:48:56 PDT Header is genuine too because it was made by yahoo. So the mail account most likely is [email protected] and actually owned by the person that sent the mail, which was definately sent from 80.87.84.30 in that case. __________________ "Think about it a little more and you'll agree with me, because you're smart and I'm right." - Charlie Munger

05-24-2006, 07:35 AM	#12
Your Mothers Secret Confirmed User Join Date: Jul 2005 Posts: 240	so now you can drive right over to 80.87.84.30 and call him a name

05-24-2006, 10:28 AM	#13
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,292	well that would make sense, the person has told me they're from Ghana... so that checks out... thx guys =)