1

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me know>

MIME-Version: 1.0 Received: by 10.25.30.3 with HTTP; Thu, 6 Nov 2014 19:58:50 -0800 (PST) Date: Thu, 6 Nov 2014 21:58:50 -0600 Delivered-To: rachel.levin@gmail.com Message-ID: Subject: URGENTE From: Rachel Levin To: Rogelio Delmott Content-Type: multipart/alternative; boundary=089e0112c59ea08a6405073cd48d

--089e0112c59ea08a6405073cd48d Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Rogelio, Borra por favor inmediato todos mi correos a tu cuenta, washington no debe saber nuestra relaci=C3=B3n

--=20 Rachel Levin www.rachelslevin.com

--089e0112c59ea08a6405073cd48d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Rogelio,Borra por favor inmediato todos mi correos a = tu cuenta, washington no debe =C2=A0saber nuestra relaci=C3=B3n=C2=A0
--
Rachel Lev= in
http://www.rachelslevin.com">www.rachelslevin.com

--089e0112c59ea08a6405073cd48d--

  • 1
    The only IP address in there is 10.25.30.3 -- an internal IP address used by a google server. (IP address that start with 10. are used for private internal IP addresses ). Change your password and/or enable 2-factor authentication. Don't access your email on public computers that you do not control (and could be using a keyloggers to steal passwords). – dr jimbob Nov 8 '14 at 6:05
3

The short answer is that it's possible there is no way to find out more details about this. You should definitely enable two-factor and change your password ASAP. That being said, I can give you a few suggestions if you want to try to find out more.

Google deliberately masks source IPs in their SMTP headers to protect your privacy. This is why you see a 10.xx.xx.xx IP, which is internal only. However, if you log into Gmail and go to the Last account activity section in the far lower right (below your email), you can see IPs that have logged into the system with your account credentials. You can find your IP by going to whatismyip.com. Once there look for IPs that don't match that. You could then search for "ip whois" on a search engine and find out more details about the IPs in question. Keep in mind whoever did this could have used a proxy service, making it difficult if not impossible for you to find out more details. To go further at that point it would likely have to involve law enforcement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.