At work today, someone of limited integrity has been using a group email address, to send company wide threatening emails. " I am going to sabotage this place... I'm in the building - try to find me..." Such tom-foolery

How can I find out what device was used to send the email and if possible what person?

  • 3
    The mail server logs. These might tell you where the message entered the system (also whether it was sent from inside or from outside). Then it depends on how tech-savvy this person is. Careful before you accuse people though. One possible scenario is that this person installed a program on a co-worker's machine in the past. And that that program only sent the message now. This would be one way to make a co-worker look bad. – S.L. Barth - Reinstate Monica Apr 12 '17 at 11:31
  • 2
    You can also look at the mail headers, there are tools that will help you anlayse them such as mxtoolbox.com/EmailHeaders.aspx it may give an indication as to its origin – iainpb Apr 12 '17 at 14:01
  • 1
    Welcome to Security StackExchange. Be sure to take the tour so you can see how this works: security.stackexchange.com/Tour – SDsolar Apr 12 '17 at 20:43

While there might be indications and pointers in the email and logs if the offender wasn't careful, email as is doesn't provide any ways of mapping mails to locations.

Content of the mail, including all headers, is totally up to the sender. Thus, you can't trust any info that you extract from the mail itself. I'd call it easy to forge, if there was even the slightest hurdle.

You can look into your server's logs to figure out which host forwarded that mail to you. Usually, that wouldn't make you any smarter - either it's not some large anonymous mail provider abroad, or someone else's mail server, and the account on that used to send the mail might just as well be stolen.

  • 1
    Upvote. Headers can be spoofed and VPNs can be used, TOR, etc., etc. While these are really great methods, the chances of success depend entirely on how clever the person sending the emails is. As for the content, perhaps there are clues there that will help. If they are truly, really, for-real threats, and if they seem immediate, then perhaps it is time to call cops in to take a look. But if you do, they will want to look at everything, not just a single email. – SDsolar Apr 12 '17 at 20:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.