2

I’m not a security expert.
I wasn't sure if I should post this question here or in "exploit".
I have searched for answers before posting....

Could anyone tell me how I can determine if emails are being sent from a particular computer?

The situation is this. A friend of mine is getting prank or “bogus” email messages. He believes it is being sent by one of his students as a prank. He does receive legitimate email from the parents. But he believes that the kid is using his mom’s email account.

It appears that this punk kid used his mom’s email account to originate emails. Also, he signed up for some dating (or porn site?) named “myzamana.com” and signed his mom’s name so that my friend is now getting solicitation emails from that web site.

I know that DHCP routers will retain the IP address assignments for some duration as set in the router config. Typically in a home there are not too many devices connecting, and the router can retain the IP address assignments of each connecting device. But one would have to know the address assignments for the devices in the first place in order to determine the originating device sending an email address. Correct?

My first answer to my friend is that it is not possible to determine the actual computer that was used (e.g. the kid used his own computer but logged in using his mom’s account) by simply looking at email message headers, partly for the above reason. All I can glean from the attached email header is that there are some 10.x.x.x IP addresses but these are just private LAN IP addresses.

I’m enclosing some email headers that my friend forwarded me (below). I edited the legitimate email addresses for privacy considerations. Can anyone enlighten me, even if that means pointing me to some education links where I can read up on the relevant appropriate technology.

Many thanks,

"punk kid name"
Delivered-To: [email protected]
Received: by 10.58.24.131 with SMTP id u3csp144140vef;
        Fri, 30 May 2014 17:40:50 -0700 (PDT)
X-Received: by 10.42.244.201 with SMTP id lr9mr19465050icb.2.1401496850161;
        Fri, 30 May 2014 17:40:50 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm49.bullet.mail.ne1.yahoo.com (nm49.bullet.mail.ne1.yahoo.com. [98.138.120.56])
        by mx.google.com with ESMTPS id d9si11587227icm.107.2014.05.30.17.40.49
        for <[email protected]>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Fri, 30 May 2014 17:4punk kid name0:50 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 98.138.120.56 as permitted sender) client-ip=98.138.120.56;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 98.138.120.56 as permitted sender) [email protected];
       dkim=pass [email protected];
       dmarc=pass (p=REJECT dis=NONE) header.from=yahoo.com
Received: from [127.0.0.1] by nm49.bullet.mail.ne1.yahoo.com with NNFMP; 31 May 2014 00:40:49 -0000
Received: from [98.138.100.111] by nm49.bullet.mail.ne1.yahoo.com with NNFMP; 31 May 2014 00:37:49 -0000
Received: from [66.196.81.173] by tm100.bullet.mail.ne1.yahoo.com with NNFMP; 31 May 2014 00:37:46 -0000
Received: from [98.139.212.244] by tm19.bullet.mail.bf1.yahoo.com with NNFMP; 31 May 2014 00:37:46 -0000
Received: from [127.0.0.1] by omp1053.mail.bf1.yahoo.com with NNFMP; 31 May 2014 00:37:46 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 94636 invoked by uid 60001); 31 May 2014 00:37:46 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1401496666; bh=ZQq8j8cv0S/vLsuV2Vmu786k69/gyMEKBYaXT4My+6I=; h=Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=oU1u4UVl7cNrpXN9BdprnCIBkVmUnBeh7y3rC+YQMjvXoOc265CsjYfkzwpWv40CSnACtefYnJAE621Y63zS9aLJATta2d5VoiSiJN4TV1Z88cnIDLGBunEpxq9YjtUhbLWkqEtK4yoPbwiQ2lnbBEpgHxhMKVadD3i4NtW4Skw=
X-YMail-OSG: Tv93FNQVM1nHpslRrq38uX54Qs1mrXND6AGkLivh4iV67LF
 lCGJX5KJXeoCJom2DvBuq80yRsnpHgFDFvRWGKiOQ8AgdnS7dB38VIFB0Glh
 DC5Tsgn52YN4WelLywOQRkPRTKxrTIGotKWe8OAcWpcjMrELuo87QlgUEuWq
 vxTRdiRIFGpWspv7pinbxDDrAMLLDKzY4rdHs6qQGMm7w.sQNit7WZaDkoKu
 Ab5KJpg.gctZAcgpTiijQdNQY35v5H8YDQoKxpqpDdorOXbQrRIJrLBzZ6Yw
 MCQMqFWnMydophCUClmzCjxuoClI5sdQie5c3aBQ8C92KjhraX4MdWYoO__u
 co.BT4Nl9sM7bbm47S9CcOSIeMUdQhSufdZUBV2ac.ItfI516XK.R7iMrr8r
 0L5XWGIjoLQWt1muuxXg_DqR7wSXJtqOKzJh7USPWNwAG13fUrSihEmUuSAz
 iJOPoFPCk7b8q3QShmHXPvTbxtj5kHwIv4UPXSMyVv0qTVwGIzSj9zdKLFcu
 4QMaqe0WlyJOi8Ac-
Received: from [209.79.72.16] by web162306.mail.bf1.yahoo.com via HTTP; Fri, 30 May 2014 17:37:45 PDT
X-Rocket-MIMEInfo: 002.001,SGVsbG8gT1ZIUyB0ZW5uaXMgY29hY2guIE15IG5hbWUgaXMgUm9nZXIgV2lsc29uIGFuZCBJIGFtIGN1cnJlbnRseSBhbiA4dGggZ3JhZGVyIGF0dGVuZGluZyBNYXJpbmUgVmlldyBNaWRkbGUgU2Nob29sIGFuZCBhbSBpbnRlcmVzdGVkIGluIGNvbWluZyBvdXQgYW5kIHBsYXlpbmcgZm9yIE9WIG5leHQgeWVhci4gSSBoYXZlIGFwcHJveGltYXRlbHkgNyB5ZWFycyBvZiBleHBlcmllbmNlIGFuZCBoYXZlIHBhcnRpY2lwYXRlZCBpbiBzZXZlcmFsIGxvY2FsIHRvdXJuYW1lbnRzLiBJIGFtIGF3YXJlIHRoYXQBMAEBAQE-
X-Mailer: YahooMailWebService/0.8.188.663
Message-ID: <[email protected]>
Date: Fri, 30 May 2014 17:37:45 -0700 (PDT)
From: punk kid name <[email protected]>
Reply-To: punk kid name <[email protected]>
Subject: Freshmen Tennis
To: "[email protected]" <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1844268657-78743074-1401496665=:6237"

--1844268657-78743074-1401496665=:6237
Content-Type: text/plain; charset=us-ascii

Hello tennis coach. My name is punk kid name and I 

**************************
Mom's name - myzamana ..."
Delivered-To: [email protected]
Received: by 10.58.73.99 with SMTP id k3csp8490vev;
        Tue, 10 Jun 2014 09:01:52 -0700 (PDT)
X-Received: by 10.68.253.73 with SMTP id zy9mr12854824pbc.114.1402416112032;
        Tue, 10 Jun 2014 09:01:52 -0700 (PDT)
Return-Path: <noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com>
Received: from m1.myzamanamail.com (m1.myzamanamail.com. [192.155.81.148])
        by mx.google.com with ESMTP id bl3si34767769pbc.235.2014.06.10.09.01.51
        for <[email protected]>;
        Tue, 10 Jun 2014 09:01:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com designates 192.155.81.148 as permitted sender) client-ip=192.155.81.148;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com designates 192.155.81.148 as permitted sender) smtp.mail=noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com;
       dkim=pass (test mode) [email protected]
To: [email protected]
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=myzamanamail.com;
    s=230211; t=1402416111;
    bh=vQNWAs+8XofFui2UBUGRZW3n9/OFpvkEbBi5fDLy1ew=;
    h=From:Reply-To:Subject:Date:List-Unsubscribe;
    b=RIXG4mCEH5JbLPw9iuVS9Sm0gn9BPuOgbM6hlB69As12LOG+QfiLUMwsABcDFuKlE
     1sqXUm7f2rGkjGlaaEGH+cartvcwOAVBpxcZmptK0oy1jjOBI6IKDF5sx90pVQir7J
     OdqDt4CSXoTQJW3+sHPF1tDKv8YmotltGkqKYF1M=
From: Mom's name <[email protected]>
Reply-To: noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com
Subject: =?utf-8?B?4piFIE5pcywgTGluZGEncyBGYXZvcml0ZSBQaG90b3M=?=
Date: Tue, 10 Jun 2014 16:01:51 +0000
X-LibVersion: 3.3.2
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="_=_swift-121288024853972bef9e5808.62301993_=_"
Content-Transfer-Encoding: 7bit
X-Mailgun-Variables: {"email_id":"b-189953972bef97785214693711","hash":"48a8d467be3e320fd4c02dca0f600183"}
List-Unsubscribe: <mailto:abuse+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com>
Precedence: bulk
Message-ID: <20140610160151.23826.1626722214.swift@dolores>

This is a message in multipart MIME format.  Your mail client should not
be displaying this. Consider upgrading your mail client to view this
message correctly.
--_=_swift-121288024853972bef9e5808.62301993_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Hi there,

Nis, Follow my favorite photos on Picbum!

https://www.picbum.com/?secret=b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183

Mom's name

****************************
Delivered-To: [email protected]
Received: by 10.58.73.99 with SMTP id k3csp264709vev;
        Fri, 13 Jun 2014 17:22:52 -0700 (PDT)
X-Received: by 10.68.190.74 with SMTP id go10mr7393567pbc.16.1402705371691;
        Fri, 13 Jun 2014 17:22:51 -0700 (PDT)
Return-Path: <noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com>
Received: from m10.myzamanamail.com (m10.myzamanamail.com. [192.155.80.145])
        by mx.google.com with ESMTP id rd13si6293369pac.216.2014.06.13.17.22.51
        for <[email protected]>;
        Fri, 13 Jun 2014 17:22:51 -0700 (PDT)
Received-SPF: pass (google.com: domain of noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com designates 192.155.80.145 as permitted sender) client-ip=192.155.80.145;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com designates 192.155.80.145 as permitted sender) smtp.mail=noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com
To: [email protected]
From: Mom's name <[email protected]>
Reply-To: noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com
Subject: =?utf-8?B?4piFIE5pcywgTGluZGEncyBGYXZvcml0ZSBQaG90b3M=?=
Date: Sat, 14 Jun 2014 00:22:51 +0000
X-LibVersion: 3.3.2
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="_=_swift-1367413788539b95db4e1080.38411787_=_"
Content-Transfer-Encoding: 7bit
X-Mailgun-Variables: {"email_id":"b-3424539b95db08b54849462487","hash":"879174704e403edcc51d159cfdef9361"}
List-Unsubscribe: <mailto:abuse+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com>
Precedence: bulk
Message-ID: <20140614002251.26711.117550881.swift@hulk>

This is a message in multipart MIME format.  Your mail client should not
be displaying this. Consider upgrading your mail client to view this
message correctly.
--_=_swift-1367413788539b95db4e1080.38411787_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Hi there,

Nis, Follow my favorite photos on Picbum!

https://www.picbum.com/?secret=b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361

Mom's name
Improve this question
0

1 Answer 1

Reset to default
2

Looking at the first message, I see: Received: from [209.79.72.16] by web162306.mail.bf1.yahoo.com via HTTP; Fri, 30 May 2014 17:37:45 PDT That is probably the address of the router from which the mail originated, and not the address of a PC which would be behind the router.

A search on 209.79.72.16 gives me some confusing information; it's either in Richardson, TX or Orange County CA. A little poking makes me believe Orange County is right. So, does Orange County make sense in the context of where you think the punk kid is likely to be?

If so, then that IP address belongs to the Orange County Department of Education. Could the kid have sent this from school? The OCDE IT people might be able to trace it to a particular computer from their logs, given that you have a timestamp.

The other two appear to have come from myzamana.com, which makes sense if the kid signed you up. You might try your email address with their "Forgot password?" link, change the password on the site, and remove any email addresses.

Edited to add: Given that the message that seems to have come from OCDE was from May, it doesn't seem likely that the OCDE IT staff will have logs from that long ago. It won't hurt to ask, though.

Also added: Email headers are added at the top; you can trust the first one because it will have been added by your own email server or that of your email provider. You then read down the list, looking for a discontinuity. That is likely to indicate a forged header.

I scoped in on the header with the IP address 209.79.72.16 because everything else looked OK and that one said Yahoo received the mail via HTTP, i.e. from someone using a web mail client.

There is an email header analyzer here: http://mxtoolbox.com/EmailHeaders.aspx It didn't have anything to add to my own analysis unless I missed something.

For education, see the link in the "Possible duplicate" message.

Improve this answer
3
  • Yes, you are correct; it's Orange County, California. I'll ask my friend if he can talk to his IT department in order to see if logs are available. Thank you for your reply....
    – rhimbo
    Commented Aug 20, 2014 at 5:32
  • Bob, one additional question for my edification. How did you discern any information about Richardson, TX? I used nslookup on IP address 209.79.72.16 but saw a DNS name with ocde.k12.ca.us at the end; same result using "host". Thanks....
    – rhimbo
    Commented Aug 20, 2014 at 15:04
  • I used a web search on the IP that showed it being in TX. My guess: It was, at one time, and AT&T moved it. Everything else pointed to OCDE.
    – Bob Brown
    Commented Aug 20, 2014 at 15:59

Not the answer you're looking for? Browse other questions tagged .