Closed Thread
Page 1 of 3 123 LastLast
Results 1 to 10 of 23

Thread: How to find email headers

  1. #1
    Join Date
    Feb 2007
    Location
    In A Glass House
    Posts
    8,252

    How to find email headers

    OK, we should have done this a long time but we didn't. So here it is. I will build it, or other admins will help build it.

    What is an email header?
    An email header provides all the information about an email you received. That includes really important things like where the email originated from. Don't write us asking us to arrest some scammer if you don't give us an email header. It can't be done.

    Why do you (AFI) want full email headers?
    An email header will show the originating ISP (i.e. where the email came from) and it also tells us the route that an email took from the scammer's computer to yours. We don't use all of that information but other people ;) around here do.


    An email header does not look like this:

    From: Mr. James Blaire <click.peter45@aliceadsl.fr>
    Subject: CONTACT FEDEX COURIER COMPANY
    Date: Friday, September 19, 2008,

    That does not tell us very much except the email account the scammer used to send the email and the name on the account. It also tells us the date he sent the email. That's about 20% useful information. In short, it really does not provide much that is useful.


    An email header is longer and looks something like this (this is a yahoo email header, an example):

    X-Apparently-To: [your_email@address.com] 203.216.249.210; Tue, 23 Sep 2008 13:16:00 +0900
    X-Originating-IP: [120.12.33.215] <----This is important
    Return-Path: <scammer@scam.com>
    Received-SPF: none ([120.12.33.215]: domain of [scamer@scam.com] does not designate permitted sender hosts)
    Authentication-Results: mta127.mail.tnz.adress.com from=scam.com; domainkeys=neutral (no sig)
    Received: from 120.12.33.215 (EHLO 120.12.33.215) (120.12.33.215)by mta127.mail.tnz.address.com with SMTP; Tue, 23 Sep 2008 13:15:59 +0900
    Message-ID: <000501c91d33$051c2fb1$ece09ab2@cfgqvryg>
    From: "Yahoo boi" <scammer@scam.com> Add to contacts
    To: "Your name" <your_email@address.com>
    Subject: Hi! I'm a scammer and I want to steal your money
    Date: Tue, 23 Sep 2008 02:30:51 +0000
    MIME-Version: 1.0
    Content-Type: multipart/alternative;boundary="----=_NextPart_000_0002_01C91D33.0519E9D0"
    X-Priority: 3
    X-MSMail-Priority: Normal
    X-Mailer: Microsoft Outlook Express 6.00.2720.3000
    X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300
    Content-Length: 1445


    Do you want the body text of the email?
    Yes. The header by itself tells us where the email came from but it doesn't tell us what the email says.


    How do I post a scam email at AFI?
    Copy and paste everything including the full email header. Please be sure that you remove your email address from the post. In the above example where your email is [your_email@address.com] you can post @address.com or [x@address.com]. That doesn't affect what we do one way or another but you do not want your email to become public. Especially here.


    Find them!
    Below we will post some servers and links to specific posts about how to find headers using those email servers. Click on the email service you use and we will try to walk you through some step-by-step instructions to find the email headers.

    (Note to admins, etc. Please activate the link in these servers as you post here. Thanks)

    AOL

    Bigstring

    CompuServe

    Cox.net

    Excite

    Eudora

    Fastmail

    Gmail

    Hotmail

    Lycos

    Mail.com

    Macintosh OS X Mail

    MSN

    Netscape

    Orange Webmail UK

    Outlook

    Outlook Express

    Rediffmail

    Sify.com

    Squirrel Mail

    Thunderbird

    WebTV

    Windows Live Mail

    Yahoo (all language versions)
    Last edited by Garreg Ddu; 06-07-2009 at 05:29 PM.
    "If the law can do nothing we must take the risk ourselves...I am not the law but I represent justice..."- Sherlock Holmes
    "The good of the people is the highest law"- Cicero

  2. #2
    Join Date
    Feb 2007
    Location
    In A Glass House
    Posts
    8,252

    Hotmail

    This is what hotmail says. Half the people I talk to can't get headers from hotmail.

    (From Windows Live Hotmail Technical Support)

    1. Log in to your Windows Live Hotmail account.
    2. Right-click on the message in the Message list and choose "View source."

    Note: Please make sure that you are not right clicking on the message in the preview pane.

    If you are using the classic version of Windows Live Hotmail, this feature is not available. You might switch to the full version first. You can migrate from Windows Live Hotmail classic version to the full version in the following ways:

    1. Click the TODAY page. This will show you which version you are using. If you want to switch from the classic version to the full version, click Try the full version.

    2. On the MAIL tab, click Try the full version of Windows Live Hotmail in the lower-left section of the page.

    3. Click Options. Near the top of the page, click Try the full version.
    "If the law can do nothing we must take the risk ourselves...I am not the law but I represent justice..."- Sherlock Holmes
    "The good of the people is the highest law"- Cicero

  3. #3
    Join Date
    Feb 2007
    Location
    Along the Fulham Road
    Posts
    6,077

    Excite Webmail

    Excite has upgraded their software program and finding the full headers is now much easier.

    To find the full headers simply view the message and then click on "Full Header" in the upper right corner. This displays the full header info versus the "Brief Header" info. (And be sure to post it if you post a scam email. And do remove your own email from it).

    For more help see the excite webpage at http://www.excite.com/
    "Though the pen is mightier than the sword, the sword speaks louder and stronger at any given moment." - Sir Roger Fenwick

  4. #4
    Join Date
    Feb 2007
    Location
    Along the Fulham Road
    Posts
    6,077

    Gmail

    This one is very easy now too. Once you sign in to your gmail account open the email that you want the headers for. On the right is a down arrow with several options, under the blue "Reply" arrow. Choose the one that says "Show original" then the full header and the email will open in a new tab (or window). Copy and paste the entire thing if you are posting a scam email. And do please remove your email address before you post it.
    "Though the pen is mightier than the sword, the sword speaks louder and stronger at any given moment." - Sir Roger Fenwick

  5. #5
    Join Date
    Jan 2007
    Location
    Japan
    Posts
    11,894

    Fastmail

    These are very easy. Open the email you want to check. On the far right in small letters is says "Show full header". You can then just copy and paste the header and the email. Please remove your own email address from anything you post.
    Silence is the scammer's best friend; knowledge is the scammer's worst enemy. 沈黙は詐欺師のよき友達、知識は詐欺師の天敵。Think globally, act globally.

  6. #6
    Join Date
    Feb 2007
    Location
    The Serbonian Bog
    Posts
    10,861

    CompuServe

    In the email, full headers now appear at the bottom of the email you received. Please remove your email before you post.

    For further help refer to the compuserve webpage at http://webcenters.netscape.compuserve.com/menu/
    Every time you click a scammer moans in agony; every time you post a scammer screams in pain!

  7. #7
    Join Date
    Feb 2007
    Location
    Land of OZ
    Posts
    8,388

    Yahoo.

    Yahoo Mail (Web Based)

    Click on the link under Subject to View the message. While viewing the message look at the bottom of the message on the right hand side and find the link that reads “Full Headers” and click on it. The header will be listed above the email.

    =======================

    Additional information:

    The latest versions of Yahoo Mail, using IE7 or higher, FireFox or Safari, have changed the header display mechanism. With the message open, click on the "Actions" button at the right side end of the tool-bar above the message. A drop down list will appear, with "Full Header" as the option second from the bottom. Clicking on "Full Header" will open a new window with the headers displayed, which can then be selected, copied and pasted into your reply along with the message text. Please remember to remove your own email address and any other personal information before you post.
    Last edited by Garreg Ddu; 11-16-2009 at 01:13 PM. Reason: Additional information
    *What the mind can conceive and believe, it can achieve.*

  8. #8
    Join Date
    Feb 2007
    Location
    The Serbonian Bog
    Posts
    10,861

    Netscape

    I haven't used it for a long time but this is supposed to be how it works now. In Messenger, the email reader supplied with Netscape communicator, this is what you have to do. IF you're using Windows all you have to do is press Ctrl-U (meta-U in unix, ?-U on Macintosh). This will open up a new window with the full header. Then, like most other mail servers, just copy (Ctrl-A to highlight the text). Then hit Ctrl-C to copy the body and header text and then paste where you need to.
    Every time you click a scammer moans in agony; every time you post a scammer screams in pain!

  9. #9
    Join Date
    Jan 2007
    Location
    Japan
    Posts
    11,894

    Mail.com

    Mail.com includes all of their associate companies like accountant.com, etc.

    On the left side of the message you will see:
    To:
    CC:
    Subject:
    Date:

    Right underneath it says "Show full headers". Click that link then copy and paste everything from the top where it says "from" to the bottom of the mail.
    Silence is the scammer's best friend; knowledge is the scammer's worst enemy. 沈黙は詐欺師のよき友達、知識は詐欺師の天敵。Think globally, act globally.

  10. #10
    Join Date
    Feb 2007
    Location
    The Serbonian Bog
    Posts
    10,861

    WebTV

    This is kind of old and I don't know if anyone uses it anymore but several of my friends used to use it.

    If you open the email then click the "Forward" link on the sidebar. Erase the subject line and then you will need to forward the email to yourself. Move your cursor over the first line in the body of the email (the part with the text) and hit "enter" or "return" twice which should move the cursor down to the third line in the text.

    Next, type any "Alt" and any character on the third line but do NOT hit "enter" or "return". Then hit control-X and control-v (copy and paste) the "alt" into the subject line. The "alt" character you typed should move back down into the body text.

    Finally, hit "send" and you should be able to open the new email.

    Now, wasn't that easy? With an email like that you can see why people use yahoo or something.
    Every time you click a scammer moans in agony; every time you post a scammer screams in pain!

Closed Thread
Page 1 of 3 123 LastLast

Posting Permissions

  • You may post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts
  •