 |
|
|
|
|
Examples of E-mail Headers To analyze headers read from bottom to top, starting from the From: line. Understand that each location or "hop" which handled the message adds one Received: line above the last. The originating IP address should appear in [brackets] not (parentheses) only. The top, or most recent Received: line will be the e-mail server that you accessed to check your e-mail. Most of the time the originating IP address will be in the first set of brackets, as you read up the headers. Time zone information may help you to pick out the bogus Received: lines in e-mail headers. The true originating IP addresses are in green in the headers below. Forged portions of headers are red. Penn State user IDs in these examples have been changed to xyz123@psu.edu for confidentiality. Printable Version of this Page
Received: from f05n09.cac.psu.edu (r02a08.cac.psu.edu [146.186.15.18]) RAA134936; for Tue, 2 Dec 2003 17:28:11 -0500 Date: Tue, 2 Dec 2003 17:28:11 -0500 Message-Id: <200312022228.RAA134936@f05n09.cac.psu.edu> X-PH:V4.1@f05n09 To: xxx <xyz123@psu.edu; Reply-To:admin@psu.edu X-Mailer:The Bat! (v1.61) X-Priority: 2 (High)Subject: your account anolyypc MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------CEDF5D290026C8C"-----------CEDF5D290026C8C Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hello there, I would like to inform you about important information regarding your e-mail address. This e-mail address will be expiring. Please read attachment for details. Best regards, Administrator ureukouk The Received: “paragraphs” give information about the three hops of this e-mail’s travel, a simple three step trip, and all of it actually happened. There are no forged Received: lines in this example. e-mail headers are always read from last to first, as the server at each hop adds its own information to the beginning of the headers. This e-mail traveled from a customer of Adelphia Cable, to Penn State, to the person it was addressed to. ******** A word about the timestamps found throughout the headers, which indicate the date, current time, and time zone of each hop. Here is a sample: Mon, 1 Dec 2003 03:10:09 -0500 The very last part of the timestamp, -0500, is the time difference in hours, from Greenwich Mean Time (GMT), which is indicative of the time zone at the location of the hop. In the Eastern Time Zone, we are -0500 during Eastern Standard Time, and -0400 during Eastern Daylight Time. In the Pacific Time Zone, they are at -0800 during Pacific Standard Time, and -0700 during Pacific Daylight Time. (three hours behind Eastern Time) In e-mail from the United Kingdom, you will see -0000 or GMT/UTC, from Japan you will see +0900. Under most Internet traffic conditions, it only takes a couple of seconds to move from one hop to the next, even if an e-mail travels a great physical distance. The time an e-mail takes to travel one hop within a 100 MBS network, can be measured in milliseconds. Time zone information may help you to pick out the bogus Received: lines in e-mail headers, when determining the portions of the headers that have been forged. For example if the Received from: entries are several hours apart, have the wrong time zone, or non-sequential date/time.
abc123@e-mail.psu.edu>; Mon, 1 Dec 2003 10:29:49 -0500 Received: (from daemon@localhost) by f04n09.cac.psu.edu (8.9.3p2.1/8.9.3) id KAA39602 for abc123@e-mail.psu.edu; Mon, 1 Dec 2003 10:29:48 -0500 Received: from smtp3.libero.it (smtp3.libero.it [193.70.192.127]) by f04n09.cac.psu.edu (8.9.3p2.1/8.9.3) with ESMTP id KAA48974 for <xyz123@psu.edu>; Mon, 1 Dec 2003 10:29:46 -0500 Received: from libero.it [193.70.192.64] by smtp3.libero.it (7.0.020-DD01) id 3F6F068F008B77EC; Mon, 1 Dec 2003 16:29:42 +0100 Date: Mon, 1 Dec 2003 16:29:42 +0100 Message-Id: <HP831I$F83BCC286922B6E1F0C969DA2A7D7216@libero.it> Subject: hello MIME-Version: 1.0 X-Sensitivity: 3 Content-Type: text/plain; charset=iso-8859-1 X-PH: V4.1@f04n09 From: "philip_elim\@libero\.it" <philip_elim@libero.it> To: "philip_elim" <philip_elim@libero.it> X-XaM3-API-Version: 4.1 (B19) X-type: 0 X-SenderIP: 66.133.34.12 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by seawolf.aset.psu.edu id KAA2224280
Dear Respectful I have to first of all apologise for taking you unawares by the
contents of this message. I had to send the message straightaway because
of the short time involved in what I demand of you. Please treat this
message with utmost seriousness and swiftness. Apart from the fact that you will be adequately rewarded, I will
forever show my gratitude. I am philip Savimbi, son of the late Angolan Leader Gen.Jonas Savimbi who was killed last year. I got your contact details from the internet because I really have no time and I needed an anonymous person abroad whom I hope I can trust. I pray I am not making wrong judgement by coming to you. 80.88.128.12]is not forged. Received: from f05n13.cac.psu.edu
(r02a04.cac.psu.edu[146.186.15.14]) by f05n13.cac.psu.edu (8.9.3p2.1/8.9.3) with SMTP id SAA307170 for <xyz123@psu.edu>; Mon, 1 Dec 2003 18:20:00 -0500 Message-ID: <20031201231959.79070.qmail@web25009.mail.ukl.yahoo.com> Received: from [80.88.128.12] by web25009.mail.ukl.yahoo.com via HTTP; on, 01 Dec 2003 23:19:59 GMT Date: Mon, 1 Dec 200323:19:59 +0000 (GMT) X-PH: V4.1@f05n13 From:=?iso-8859-1?q?adele=20thomas?= <adelethomas03@yahoo.co.uk> Subject:RE: MESSAGE To: xyz123@psu.edu MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit FROM THE DESK OF MR ADELE THOMAS ADELE THOMAS AND ASSOCIATES e-mail:adelethomas01@yahoo.co.uk ATT:Sir/Madam, RE:YOUR INHERITANCE FUND CLAIM OF LATE MRS CASANDRA RYAN. First, I must solicit your confidence in this transaction, this is by virtue of its nature as being utterly CONFIDENTIAL. I am Adele Thomas,legal adviser to the Executive Director (Banking and Treasury Operations)with the Union Bank of Nigeria.
The first Received from line is faked. The second has a forged portion, but the originating IP address in brackets is the true first hop. Received: from
f05n11.cac.psu.edu (r02a07.cac.psu.edu [146.186.15.17])by
seawolf.aset.psu.edu
BRAND NEW COLON CLEANSER PRODUCT Three hops, within a spam e-mail, where the spammer attempted to generate confusion by inserting 3 bogus hops into the headers. The first three hops are forgeries because the time stamps don't match, and the message was not passed to next machine properly. When a message from a hop is received by the next hop, the by must correlate with the domain name of the subsequent hop. sparc.isl.net and its corresponding IP address should be reflected in the next Received: from line, but it is not. A similar situation exists in the second and third Received: from lines. 67.22.42.81 is a forged optional machine name; it does not correspond to the true IP address [68.170.238.28] . Received: from f05n11.cac.psu.edu
(r02a07.cac.psu.edu [146.186.15.17]) Mining Stock News achieved record results for our Investment Alerts in |
|
|
The Pennsylvania State University © 2005.
All rights reserved. Alternative Media - Nondiscrimination Statement This site maintained by Security Operations and Services, a unit of Information Technology Services.
For assistance, contact
Security Operations and Services. Last revised: 05/16/2005
|
