1

After someone has hidden their IP address so that it doesn't appear in the header of an email, is it possible to find the sender via another method?

Improve this question
2
  • 2
    Yes, but only by reviewing the logs of the email server they used. So, for the average person, no.
    – schroeder ♦
    Nov 28, 2017 at 16:04
  • 3
    The sender itself does not write its IP address in the Received-Header. This is done by the receiving mail server. Thus, the sender cannot hide its IP from the Received header. He can only use a MTA which does not write the IP in the Received header or use a different way, like sending using some formular on the web where the author of the formulare does not include the visitors IP in the mail.
    – Steffen Ullrich
    Nov 28, 2017 at 16:08

3 Answers 3

Reset to default
-1

Check the (server) logs

All the involved servers should be keeping logs of the activity, so it may be possible to find the email sender that way.

Let's suppose that you were sent a death threat. You only have the IP of the server that sent it to you, not the original one (that could be fake, btw). After you report the threat to the police, a judge would ask that server operator for the origin of that email. It could for instance have been received from a different server, whose operator would then be inquired about it. Which could see on his logs that it was sent from ip 1.2.3.4 by someone who logged in with account schroeder. In turn, asking the ISP about IP address 1.2.3.4 at that time may led us to a northern workshop, etc.

Improve this answer
-1

A practical technique that has been used many times effectively involves HTML embedding a 1x1 pixel image in a reply mail, sourced on a webserver you control. Only the recipient should pull that image from the server. HTML embedded images are not attachments, google <img src...

It is somewhat uncommon for email clients ( and even less likely for browser based email account access ) to block images from being loaded, so there is a fair chance of success.

Other than that, schroeder has answered canonically; you’ll need mailserver log access - perhaps you can convince an administrator, if the email was somehow threatening, lewd, etc.

Edit: To clarify, I suggest that OP reply to the sender with a crafted email that links to a 1x1px image on a webserver he controls/can read www access log on. Some of these provide user-level webpages ( host.tld/~user ), with access_log in the user’s folder.

Improve this answer
4
  • Not sure how the first paragraph helps identify the "sender" unless such an image is included and you figure that the sender is the only person with control of that hosting server (if the sender has hidden their IP in the header, I doubt they'd embed an image on a private server)
    – potatopeelings
    Nov 28, 2017 at 23:17
  • @potatopeelings Gmail scrubs originating IP. It is becoming more common. In any case, OP wants the IP of the sender of an email, and this is one method to do this.
    – user2497
    Nov 28, 2017 at 23:41
  • Nope. The OP is the recipient and wants the IP of the sender. You seem to be answering the opposite question.
    – Ángel
    Nov 29, 2017 at 0:43
  • 1
    It is not only common, but pretty much standard practice for mail clients to block external images from being loaded by default - usually with an exception such as if the sender is already in the recipient's address book.
    – thomasrutter
    Nov 29, 2017 at 3:35
-1

All email comes from some IP address, and it's not possible to send email without revealing the sender's IP address - because sending email requires two-way communication. The receiving server can see which IP address contacted them.

The sender does not need to announce their IP address anywhere in the SMTP communication or email headers; instead, it is the receiving server who records this and (typically, but not mandatory) adds it into a "Received" header on the receiver's side. The receiving server also typically writes it to their log.

You can see the sender's IP address in two ways: by checking the logs at the receiving mail server, or by checking the "Received" header added by the receiving mail server.

A few notes:

  • Not all mail clients will expose the raw headers to the user.

  • An email may have multiple Received: headers, and it may not be obvious which one is relevant. Any Received: header already present in the email when it was received needs to be ignored (as its content may be faked). Receiving mail servers add new Received: headers to the top, so you want to read them from the top. Reading from the top, find the top-most Received: header that refers to having received the email from an outside network. This will also be the bottom-most Received: header to be added by the receiving server.

  • Some email may have got to you via an open relay or insecure web form. In these cases you will see the IP address of that open relay or insecure web form and it's not possible to definitively know any upstream IP addresses. This doesn't have to be a big impediment: you should still consider the offending party to be the mail server that transmitted the mail to you, as every mail server should be responsible for what they send over the open internet (which is why open relays and insecure web forms are bad players in the fight against spam and great effort goes into blocking them or taking them down).

  • Knowing someone's IP address doesn't always reveal much about who they are. Anybody can rent an IP address by paying for a server or virtual server somewhere, and sometimes by attacking and compromising an innocent person's computer or server.

Improve this answer
1
  • Can a helpful person explain the downvote (on this answer as well as others) so I know what's wrong?
    – thomasrutter
    Dec 14, 2017 at 1:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .