Posting headers

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Jan 27, 2009 3:56 am

sorry mods and guys but for the life of me I can't locate the link where I paste headers to determine where an email is originating from please help

Elite Baiter Joined: 19 Jan 2008 Posts: 1043

The one you are thinking of is probably http://headertool.apelord.com/headers. An excellent tool, but you can use any IP locator if you know how to read a header.

Posted: Tue Jan 27, 2009 5:38 pm

hi, thanks but the link does not work

Posted: Tue Jan 27, 2009 5:40 pm

Just use http://headertool.apelord.com

Posted: Tue Jan 27, 2009 5:42 pm

Had something ready for that a bit more than you asked for, but copy and paste is my thing Laughing

Quote:

Email short for electronic mail as it is send over the Internet.
Two kind of programs, the ones installed on your computer, like MS Outlook and Thunderbird(many more out there) or you send them online, that is straight from a website you log in to it on line with your email name and password. You can use them from any computer that goes on the internet.
The envelope with address is the header of the email, so your computer knows where it is going and how to get there.
How can you see that header? That of course is different for every program and you can find the solution here:
http://128.175.24.251/headers.htm or try the eater help http://forum.419eater.com/forum/viewtopic.php?t=118787

an example:

Quote:

From - Tue Sep 16 11:10:35 2008
X-Account-Key: account2
X-UIDL: 4631110f00000176
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <senders [email protected]>
X-Original-To: receivers [email protected]
Delivered-To: receivers [email protected]
Received: by secure.email.com (Postfix, from userid 99)
id 946FD379476; Tue, 16 Sep 2008 10:57:44 -0600 (MDT)
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on secure.email.com
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=7.5 tests=HTML_MESSAGE autolearn=failed
version=3.2.5
Received: from smtp.email.com (smtp.email.com [207.229.52.99])
by secure.email.com (Postfix) with ESMTP id 490B7379422
for <receivers [email protected]>; Tue, 16 Sep 2008 10:57:43 -0600 (MDT)
X-ASG-Debug-ID: 1221584261-4cfb01290000-ML5oG5
X-Barracuda-URL: http://207.229.52.99:8000/cgi-bin/mark.cgi
Received: from prdmail402.wheretolive.com (localhost [127.0.0.1])
by smtp.email.com (Spam Firewall) with ESMTP id 37C2120D3EB5
for <receivers [email protected]>; Tue, 16 Sep 2008 10:57:42 -0600 (MDT)
Received: from prdmail402.wheretolive.com (all.wheretolive.com [63.127.11.68]) by smtp.email.com with ESMTP id
UlHBf45VyBGyDplm for <receivers [email protected]>; Tue, 16 Sep 2008 10:57:42 -0600 (MDT)
Received: from PRDWWW402 ([63.127.11.68])
by prdmail402.wheretolive.com (IceWarp 9.1.1) with ASMTP id WZV02741
for <receivers [email protected]>; Tue, 16 Sep 2008 11:57:41 -0500
From: <senders [email protected]>
To: "receivers name description" <receivers [email protected]>
Reply-To: "" <senders [email protected]>
Date: Tue, 16 Sep 2008 11:57:41 -0500
X-ASG-Orig-Subj: Re: Subject line
Subject: Re: Subject line
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=aspNetEmail=_650ed8445136414981005eb237841911"
X-Mailer: aspNetEmail ver 3.5.2.0
X-SmartMail_v1.0_RC3: All your email are belong to us!
Message-ID: <PRDWWW402fbd17fa83de9460b8abed4218e004edd@PRDWWW402>
X-Barracuda-Connect: all.wheretolive.com[63.127.11.68]
X-Barracuda-Start-Time: 1221584262
X-Barracuda-Virus-Scanned: by Barracuda Spam Firewall at email.com
X-Barracuda-Spam-Score: 0.00
X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=4.0 QUARANTINE_LEVEL=1000.0
KILL_LEVEL=4.0 tests=HTML_MESSAGE, NO_REAL_NAME
X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.1.5732
Rule breakdown below
pts rule name description
---- ---------------------- --------------------------------------------------
0.00 NO_REAL_NAME From: does not include a real name
0.00 HTML_MESSAGE BODY: HTML included in message
Status: O

--_=aspNetEmail=_650ed8445136414981005eb237841911
Content-Type: text/plain;
charset="us-ascii"

That's a lot of rubbish to go through to find out where it came from, so what, we have a computer that can do that.
Open up a new tab and load "http://headertool.apelord.com/headers" or make a bookmark and run it from there.
Enter the rubbish they call a header there and click.
You get something like this.
IP Address Probable Country Whois Google DNS stuff urgentmessage.org
207.229.52.99 Canada (Pincher Creek)*
63.127.11.68 United States (Eden Prairie)* Whois Google DNS stuff urgentmessage.org

3.5.2.0 United States* Whois Google DNS stuff urgentmessage.org
* The last IP listed is usually the originating IP address
we'll do the Whois Google DNS stuff urgentmessage.org stuff later here, if I don't forget it

The last IP# is the IP# were the email originated and it seems in this case that it was an online email program that
doesn't show the IP# of the sender, but just the IP# of the email1 server.

There are lots of website that can find out where that IP# came from, they don't all agree, but that's because they claim
they have the best database, what else is new.
Some I use.
http://www.geobytes.com/IpLocator.htm?GetLocation
http://www.ip-adress.com/ip_tracer/
http://whatismyipaddress.com/staticpages/index.php/lookup-ip
http://www.komar.org/cgi-bin/ip_to_country.pl
and there are many more. Now you have an idea where your friend might be, not that it helps much, it's usually out of
the country you're in, so you're safe if your email program can't show him the same info.
When you use Gmail/Hushmail/Fast mail online they will not show your computer IP# to your friends so they have no way
to figure out where you are. If you set those email accounts up with all fake info, a nice baiter name(not related to
your eater name or anything from Real Life), there's no way they can ever figure out where or who you are.

Okay as promissed, the Whois or "who is" will tell you a bit more about the ISP that's providing the IP#, it's usually
their headquarters so in this case it has nothing to do with me as my ISP rents a line from them and Burnaby is a long days ride
from my home.
The Google tab should be clear, eh
The DNS stuff is just DNS stuff, tells you a bit more about the ISP of my ISP and the name of my ISP that's it.
urgentmessage.org was a website/database of a former eater member who had the skills to set up a way to search endless
scam emails and extract valuable data out of them, like names, IP#, email addresses and telephone numbers so you could
look up what else your friend had been up to, where that phone number was used before, simply link data together so you
got an idea how that man worked, what his game was and how long he had been at it. I will miss this very much!