3

Recently my contact list was shared through some emails recently sent from my account. I would like to find out who did this as it has caused me some financial loss.

When I look at the email header, it looks exactly like my IP address but I know I didn’t send it. How can I identify that it wasn’t me and find out who did it?

How can I prove that the IP address was spoofed/faked? What can I try doing on my own before contacting a professional?

I’m using a Hotmail account.

  • 1
    Are you using Hotmail webmail? If so, your IP address won't be in the email anyway – multithr3at3d Jun 12 '18 at 22:16
  • I would say the IP is just written into the E-Mail. So no need to spoof it. just write the last ip of the login log. you should check your hotmail account and change passwords – CD Rohling Jun 5 at 10:46
  • I notice that the IP address of the sender is rarely in the e-mail headers. You can usually find a link-local IP address (127.0.0.1) or the IP of the SMTP server that you might have mistaken for your IP address. – A. Hersean Jun 5 at 12:44
  • Forgive me for being a bit naive, but for you, what do you think an IP address looks like? "123.45.67.89", "1234:4567::8901" or "john.doe@example.com"? – A. Hersean Jun 5 at 12:48
  • Could you provide more details on how your contact list was shared? Was it your full contact list, selected persons, or a seemingly random part of your contact list? – A. Hersean Jun 5 at 12:50
1

You either had

  • a guessable password
  • a password found in a previous data breach
  • you fell for a phishing attack

The attacker likely didn't spoof anything ... they probably control your Hotmail account. If Hotmail has a screen that shows you recent logins you may be able to see where the attacker is logging in from but that won't help much.

Instead you need to

  • change your password
  • change your backup / secondary email address
  • enable 2FA/MFA to prevent this from happening again
  • What is the relation between an IP address and a password? Or even between a sender address in a mail and a password? What evidence is there that the account has been used? – Serge Ballesta Jun 5 at 10:09
  • @SergeBallesta The contact list of PattyS was leaked. This requires the access to the account. – A. Hersean Jun 5 at 12:39
  • @A.Hersean: You are probably right, except if a part of its contact list has been extracted from another mail. As I have never seen a mail containing a contact list, I have not payed enough attention to that point. – Serge Ballesta Jun 5 at 13:00
  • @SergeBallesta The contact list could have been in CC. I asked the OP for more details. – A. Hersean Jun 5 at 13:08
0

Any header can be forged in a mail - simply it is not possible to forge all at the same time. I am really surprized that the IP address has been forged, usually only the email addresses are.

As for who did that and/or where, it is impossible to answer without more details. The common way for that kind of investigation is to analyze the full headers and try to establish which MTA were involved. If all are under control (belonging to your organization), you could have more infos from the logs of the first one in the chain.

If all are trustworthy (belong to well know organizations) you could find the IP address of the sender. But in the vast majority of case, you end on various relays and need a legal action to obtain the informations.

Anyway, faking a sender email does not even require the corresponding password...


To directly answer your question, it depends on your knowledge. It you know enough of the SMTP protocol to seriously examine the headers, you may find evidences that the mail has been forged and use them to try to prove that you have not sent them. If you do not and asked for a simple workthrough, I am afraid that no exists and you should first find an expert in SMTP and then eventually a lawyer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.