0

I would like to know whether there is anyway of extracting and verifying the ip address of someone who has sent you an email.

Is this typically stored in an email's header / metadata?

If so, can this ip address adequately identify the ip address of the original sender? If the original sender was using a VPN, would the ip address in the email header and/or metadata accurately represent the sender?

The main reason I am asking is that I am receiving quite of lot of spam emails that are coming from different email addresses but containing the same phishing email. I am confident these are coming from the same source. If I block the ip address recorded in the email's header/meta data, would this be effective? Or would I be blocking some (innocent) VPN server somewhere overseas instead of the actual culprit?

1

anyway of extracting and verifying the ip address of someone who has sent you an email.

While the IP address of the sender might be contained in the mail header it can easily be faked. Only the receiving mail server knows the real client IP address and if you trust this MTA you could check the Received-Header added by this MTA if it contains the clients IP address (not all do this). Not that depending on the path of the mail there might be several MTA involved and any MTA can change the header and the original sender can also add some fake Received-Headers to the mail.

... lot of spam emails that are coming from different email addresses but containing the same phishing email. I am confident these are coming from the same source.

Not necessarily. Spam/Phishing is often sent using rented botnets, i.e. the same mail comes from lots of different source IP address. Assuming the same sender IP all the time and blocking it would thus not help. But you might make use of real time black lists (RBL) which include typical source IP of spammers and also networks for "dial-up" accounts (i.e. home users) which are often unwillingly part of a botnet and thus used for spamming. See for example this multi-RBL check. Use of such RBL can often be added to mail servers and tools like Spamassisin can make use of RBL too.

0

I would like to know whether there is anyway of extracting and verifying the ip address of someone who has sent you an email.

Is this typically stored in an email's header / metadata?

Yes you can. Mxtoolbox is the one I used to use when I was in the job of analysing phishing emails. Extract the email headers and paste them in Mxtoolbox. It'll give you a human-readable view. You can find the IP address in the "Received" header or sometimes as a dedicated header itself like "X-Originating-IP".

If so, can this ip address adequately identify the ip address of the original sender?

In most spam/phishing emails, no. They're usually sent via botnets i.e. same email sent by multiple IPs. So blocking IPs will be a very temporary solution to your problem.

There are three to minimise this problem:

  1. You can add an anti-spam plug-in to your mail server that analyses and filters all emails received. Like Steffen Ullrich has mentioned in his answer, SpamAssassin is a popular open-source one.

  2. You can add plug-ins to your mail client that essentially do the same task as the mail server plug-ins. Spamihilator and MailWasher seem to work with most email clients. I've never used them personally.

  3. Use an anti-spam cloud service that analyses and filters all spam emails destined for your domain before forwarding them onto your mail server. MailCleaner is an example of this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.