OK, we should have done this a long time but we didn't. So here it is. I will build it, or other admins will help build it.
What is an email header?
An email header provides all the information about an email you received. That includes really important things like where the email originated from. Don't write us asking us to arrest some scammer if you don't give us an email header. It can't be done.
Why do you (AFI) want full email headers?
An email header will show the originating ISP (i.e. where the email came from) and it also tells us the route that an email took from the scammer's computer to yours. We don't use all of that information but other people ;) around here do.
An email header does not look like this:
From: Mr. James Blaire <email@example.com>
Subject: CONTACT FEDEX COURIER COMPANY
Date: Friday, September 19, 2008,
That does not tell us very much except the email account the scammer used to send the email and the name on the account. It also tells us the date he sent the email. That's about 20% useful information. In short, it really does not provide much that is useful.
An email header is longer and looks something like this (this is a yahoo email header, an example):
X-Apparently-To: [firstname.lastname@example.org] 18.104.22.168; Tue, 23 Sep 2008 13:16:00 +0900
X-Originating-IP: [22.214.171.124] <----This is important
Received-SPF: none ([126.96.36.199]: domain of [email@example.com] does not designate permitted sender hosts)
Authentication-Results: mta127.mail.tnz.adress.com from=scam.com; domainkeys=neutral (no sig)
Received: from 188.8.131.52 (EHLO 184.108.40.206) (220.127.116.11)by mta127.mail.tnz.address.com with SMTP; Tue, 23 Sep 2008 13:15:59 +0900
From: "Yahoo boi" <firstname.lastname@example.org> Add to contacts
To: "Your name" <email@example.com>
Subject: Hi! I'm a scammer and I want to steal your money
Date: Tue, 23 Sep 2008 02:30:51 +0000
X-Mailer: Microsoft Outlook Express 6.00.2720.3000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300
Do you want the body text of the email?
Yes. The header by itself tells us where the email came from but it doesn't tell us what the email says.
How do I post a scam email at AFI?
Copy and paste everything including the full email header. Please be sure that you remove your email address from the post. In the above example where your email is [firstname.lastname@example.org] you can post @address.com or [email@example.com]. That doesn't affect what we do one way or another but you do not want your email to become public. Especially here.
Below we will post some servers and links to specific posts about how to find headers using those email servers. Click on the email service you use and we will try to walk you through some step-by-step instructions to find the email headers.
(Note to admins, etc. Please activate the link in these servers as you post here. Thanks)
Macintosh OS X Mail
Orange Webmail UK
Windows Live Mail
Yahoo (all language versions)