# Tracing e-mail messages **URL:** \ **Category:** Factual Questions\ **Created:** [March 13, 2001, 7:15pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828 "2001-03-13T19:15:32Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Uplink\_Dude](https://avatars.discourse-cdn.com/v4/letter/u/7feea3/32.png) [@Uplink\_Dude](https://boards.straightdope.com/u/Uplink_Dude)\ **Post date:** [March 13, 2001, 7:15pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/1 "2001-03-13T19:15:32Z")
Hi. This is my first post. I hope it is appropriet for here. My friend has gotten an anonymous email from somebody for the last month. Nothing serious. Just sort of secret admiror stuff. Anyway, he wants to know who it is emailed him. The message is comes from a Yahoo mail account. The is this ID in the message header: (I have replace the numbers for X to protect privacy) Message-ID: \<[xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com](mailto:xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com)\> Can Yahoo tell me who this is? Will they know if the person used a fake name to sign up? ---
**Author:** ![Giraffe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/giraffe/32/129_2.png) [@Giraffe](https://boards.straightdope.com/u/Giraffe)\ **Post date:** [March 13, 2001, 7:38pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/2 "2001-03-13T19:38:38Z")
I’m certain Yahoo won’t tell you. Plus, you don’t need a birth certificate to get a Yahoo mail account, so there’s no way to know if their user information is true, in any case. However, all is not lost. A while back, I got an email informing me that Bill Gates had written an “email tracing program”, which he was paying every Internet user $5000 to test. The man is a business genius! No wonder he’s a billionaire! I forwarded it to everyone I know, but still haven’t gotten my check. 😕 I’m sure it’ll be on the market soon, though, at which point, you can use it to trace your friend’s admirer back to his/her home computer. It may even tell you what he/she looks like! ---
**Author:** ![Uplink\_Dude](https://avatars.discourse-cdn.com/v4/letter/u/7feea3/32.png) [@Uplink\_Dude](https://boards.straightdope.com/u/Uplink_Dude)\ **Post date:** [March 13, 2001, 7:47pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/3 "2001-03-13T19:47:37Z")
Giraffe, What if we told Yahoo that my friend didn’t like getting this kind of anonymous stuff. Would they then saay that the admirer’s email was a “threat” and then tell us who it is?? And if we have this MessageID thing, can Yhaoo trace that to some user because of the cookies? ---
**Author:** ![wring](https://avatars.discourse-cdn.com/v4/letter/w/838e76/32.png) [@wring](https://boards.straightdope.com/u/wring)\ **Post date:** [March 13, 2001, 7:52pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/4 "2001-03-13T19:52:53Z")
Can Yahoo? very probably they can at least get a handle on who it is. After all, when hackers do nasty stuff law enforcement agencies are able to track 'em down. will they tell you? most probably not. If it’s a criminal case (threats etc), contact your local police agency, and yahoo officials and they’ll work on it. If it’s a case of flirting… neither place will want to devote the resources to it. (and I really don’t recommend pretending that it’s a threat so that they’ll look into it)\> ---
**Author:** ![Dev\_Null](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Dev\_Null](https://boards.straightdope.com/u/Dev_Null)\ **Post date:** [March 13, 2001, 9:31pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/5 "2001-03-13T21:31:03Z")
> [@](#): > > \*Originally posted by Uplink Dude \* > > Anyway, he wants to know who it is emailed him. The message is comes from a Yahoo mail account. The is this ID in the message header: > > (I have replace the numbers for X to protect privacy) > Message-ID: \<[xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com](mailto:xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com)\> > > Can Yahoo tell me who this is? Will they know if the person used a fake name to sign up? \*\* That is not a complete message header. In order to track an email you need a complete header, that looks something like this: Received: from [smtp.xtalwind.net](http://smtp.xtalwind.net) ([smtp.xtalwind.net](http://smtp.xtalwind.net) [205.160.242.11]) by [ctc.swva.net](http://ctc.swva.net) (8.9.3/8.9.3) with ESMTP id VAA20832 for \<[XXXXXX@swva.net](mailto:XXXXXX@swva.net)\>; Thu, 8 Mar 2001 21:08:19 -0500 Received: from dell600 ([xtal438.xtalwind.net](http://xtal438.xtalwind.net) [204.215.255.187]) by [smtp.xtalwind.net](http://smtp.xtalwind.net) (8.11.0/8.11.0) with SMTP id f28D7gk54286; Thu, 8 Mar 2001 08:07:42 -0500 (EST) Reply-To: \<[XXXXX@xtalwind.net](mailto:XXXXX@xtalwind.net)\> From: “XXXX XXXX” \<[XXX@xtalwind.net](mailto:XXX@xtalwind.net)\> To: \<[XXXX@xtalwind.net](mailto:XXXX@xtalwind.net)\> I’ve edited out the personal stuff from this header, but you get the idea. I’ve been an antispammer for years now and I’ve gotten pretty good at reading this stuff. And while you may not be able to find a name, you will be able to find the IP of the sending computer. That may give you enough of a clue to proceed. The message ID is worthless for tracking because it is easily overwritten with anything you want it to say. Best, Dev ---
**Author:** ![Uplink\_Dude](https://avatars.discourse-cdn.com/v4/letter/u/7feea3/32.png) [@Uplink\_Dude](https://boards.straightdope.com/u/Uplink_Dude)\ **Post date:** [March 13, 2001, 10:38pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/6 "2001-03-13T22:38:54Z")
> [@](#): > > \*Originally posted by Dev Null \* > \*\*That is not a complete message header. In order to track an email you need a complete header, that looks something like this: > > [snip] > And while you may not be able to find a name, you will be able to find the IP of the sending computer. That may give you enough of a clue to proceed. > > The message ID is worthless for tracking because it is easily overwritten with anything you want it to say. > > \*\* Dev, We just checked and the IP address points to “Websafe”. It is masking the reel IP address I think. Anyway, I don’t think this person would be chaning message ID. So, if the ID is something like: \<[xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com](mailto:xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com)\> is that enough - in Theory - for Yahoo to find the person’s IP address? ---
**Author:** ![Crusoe](https://avatars.discourse-cdn.com/v4/letter/c/49beb7/32.png) [@Crusoe](https://boards.straightdope.com/u/Crusoe)\ **Post date:** [March 13, 2001, 10:58pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/7 "2001-03-13T22:58:39Z")
Okay, several things here (please forgive me if this sounds patronising, but I don’t know what your level of technical understanding is). The bad news first: you are highly unlikely to get anywhere with this. Companies like Yahoo! and Hotmail loathe having to spend time surrendering details – remember, they don’t have thousands of staff dealing with the webmail services. They will do so when forced to by legal authorities, and may well take action if the email your friend received was threatening or abusive (most likely simply deleting the account). Since it wasn’t, though, they’re unlikely to give out any details. Secondly, if the Yahoo! account is anything like my Hotmail account, they have no accurate details on the true user (according to Hotmail, my name is N/A and I live at 1 N/A Street, N/A, N/A). If this is the case, then for Yahoo! to begin tracing the real user, they would have to search through whatever IP logs they keep – a long and arduous task that they won’t start without a good reason. Okay. So you trace the IP address used to compose the email. The next problem is this: it probably won’t resolve to an actual PC anywhere. The chances are that this person is using a PC at work, through an ISP at home, at school/university or at an internet cafe. In most examples I can think of, the PCs used in these locations usually use DHCP. Since there aren’t enough IP addresses for each PC or network device in the world to have a unique address, companies and organisations buy “blocks” of IP addresses. Assuming that not everyone will be surfing the web at the same time, they then assign these dynamically (DHCP) – so I may have a different IP number every time I connect via my ISP. If this is the case, then you or Yahoo! would have to go to the ISP or administrator and ask them to go through their logs used to record which IP number was assigned to which hardware ID (the MAC number) at the point when the email was sent. Again, this may be a huge amount of effort for them. And, lastly, even if you know which physical PC the email was sent from…well, you still don’t know who the user was. If it was at an internet cafe or a university PC lab, you’re out of luck. Sorry to be a downer, but I really doubt that Yahoo! will play ball. ---
**Author:** ![handy](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@handy](https://boards.straightdope.com/u/handy)\ **Post date:** [March 14, 2001, 12:35am UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/8 "2001-03-14T00:35:51Z")
Id have to trace 20 anon emails per day!..one per month is nothing… I ran [web12813.mail.yahoo.com](http://web12813.mail.yahoo.com) through some big search engines & it didn’t show up, so more likely than not its fake too. ---
**Author:** ![Dev\_Null](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Dev\_Null](https://boards.straightdope.com/u/Dev_Null)\ **Post date:** [March 14, 2001, 1:56pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/9 "2001-03-14T13:56:15Z")
> [@](#): > > \*Originally posted by Uplink Dude \* > \*\* > > > [@](#): > > > > \*Originally posted by Dev Null \* > > \*\*That is not a complete message header. In order to track an email you need a complete header, that looks something like this: > > > > [snip] > > And while you may not be able to find a name, you will be able to find the IP of the sending computer. That may give you enough of a clue to proceed. > > > > The message ID is worthless for tracking because it is easily overwritten with anything you want it to say. > > > > \*\* > > Dev, > > We just checked and the IP address points to “Websafe”. It is masking the reel IP address I think. > > Anyway, I don’t think this person would be chaning message ID. So, if the ID is something like: > > \<[xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com](mailto:xxxxxxxxxxxx.xxxxxx.qmail@web12813.mail.yahoo.com)\> > > is that enough - in Theory - for Yahoo to find the person’s IP address? \*\* No. Yahoo (assuming it came from them) would also need a timestamp to check through logs. [web12813.mail.yahoo.com](http://web12813.mail.yahoo.com) is an actual machine name, and resolves to what I’m guessing is a web-based email host computer. There are a bunch of these along the lines of [webNNNNN.mail.yahoo.com](http://webNNNNN.mail.yahoo.com), so it’s probably one of a bunch of these web-email gateway machines. A quick search found no websafes or web-safes, so that is may be bogus. Was this message read via yahoo’s email? If not, and this header line is not forged, then the sender is on yahoo. Posting (or emailing) the full headers would sure help. Best, Dev ---
**Author:** ![Uplink\_Dude](https://avatars.discourse-cdn.com/v4/letter/u/7feea3/32.png) [@Uplink\_Dude](https://boards.straightdope.com/u/Uplink_Dude)\ **Post date:** [March 14, 2001, 5:49pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/10 "2001-03-14T17:49:31Z")
> [@](#): > > \*Originally posted by Dev Null \* > \*\* > [snip] > > [web12813.mail.yahoo.com](http://web12813.mail.yahoo.com) is an actual machine name, > and resolves to what I’m guessing is a web-based email > host computer. There are a bunch of these along the lines of > [webNNNNN.mail.yahoo.com](http://webNNNNN.mail.yahoo.com), so it’s probably one of a bunch > of these web-email gateway machines. A quick search found > no websafes or web-safes, so that is may be bogus. Was > this message read via yahoo’s email? If not, and this > header line is not forged, then the sender is on yahoo. > > \*\* Thanks for the reply, Dev. A few more technical questions… \*\* Received: from [216.104.228.158] by [web12813.mail.yahoo.com](http://web12813.mail.yahoo.com); Message-ID: \<2\*\*\*\*309153736.16808.qmail@web12813.mail.yahoo.com\> \*\* (I removed replaced some of the numbers above with \*\*\*\*) The IP address appears to be from the Safeeweb server. So I guess, the person is using that anonymous server before logging on to the yahoo mail. But technically, can Yahoo id the person using simply the message-ID and some kind of cookie placed on their computer? Is just a thing technically do-able? Or would the ID of the user have to come from Safeeweb? ---
**Author:** ![Dev\_Null](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Dev\_Null](https://boards.straightdope.com/u/Dev_Null)\ **Post date:** [March 14, 2001, 6:45pm UTC](https://boards.straightdope.com/t/tracing-e-mail-messages/57828/11 "2001-03-14T18:45:26Z")
> [@](#): > > \*Originally posted by Uplink Dude \* > > Thanks for the reply, Dev. A few more technical questions… > > \*\* > Received: from [216.104.228.158] by [web12813.mail.yahoo.com](http://web12813.mail.yahoo.com); > Message-ID: \<2\*\*\*\*309153736.16808.qmail@web12813.mail.yahoo.com\> > \*\* > > (I removed replaced some of the numbers above with \*\*\*\*) > > The IP address appears to be from the Safeeweb server. So I guess, the person is using that anonymous server before logging on to the yahoo mail. But technically, can Yahoo id the person using simply the message-ID and some kind of cookie placed on their computer? Is just a thing technically do-able? > > Or would the ID of the user have to come from Safeeweb? > \*\* I’m not sure where you are getting this safeeweb thing. 216.104.228.158 is downstream from [exodus.net](http://exodus.net), at what appears to be [fugunet.com](http://fugunet.com). Try [postmaster@fugunet.com](mailto:postmaster@fugunet.com), and send the full headers. Yahoo could indeed tell, if they are setting cookies to do this kind of thing, which they probably are not.