Every e-mail has a visible set of information on sender (From:), recipient (To:), subject (Subject:), Organization of the sender (Orgn:) etc. However, there's a great deal more hidden within, that can reveal significant information about the sender.

A little scrutiny of this hidden information may help you locate sender's country, genuineness of the e-mail used in 'From:' column, whether the sender tried to conceal his/her identity etc.

A fake sender attempting to confuse identity usually means a fraudster trying to steal your money or a virus attack, a potential hazard in either case, that can cost you a lot in terms of financial loss, computer crash etc. A little time spent on analyzing suspicious looking e-mails is an insurance against such disasters.

Those using Yahoo, Rediffmail, Hotmail or any such web-based e-mail service may think that their true identity and location are hidden. In reality - one may still find information about them by analyzing their e-mail headers.

What is E-mail Header

The part of an e-mail where such hidden information is stored is called 'header'. Header of an e-mail stores various information on the path it has traversed while reaching your mailbox - right from sender's computer. Normally, one doesn't need this kind of information and mail clients (Eudora, Outlook, Netscape etc. ) do not display it.

To see e-mail header in Netscape, open any e-mail and click

View > Page Source

For Outlook, right-click on the mail message that is still in your Inbox, select 'Options...' from the resulting popup menu Examine the 'Internet Headers' in the 'Message Options' dialog

At first look - the header may look confusing and puzzling. This is more so for spam e-mails as spammers try their best to make the header misleading. Do not lose heart - I am going to explain how to pick up right information from it.

Examining a Typical Header

Let us examine following e-mail header:

1. Delivery-date: Wed, 03 Nov 2004 23:59:47 -0600 2. Received: from bani by arjuna.banijya.com with local-bsmtp (Exim 4.43) 3. id 1CPaev-00057o-Q4 4. for abcdxyz@banijya.com; Wed, 03 Nov 2004 23:59:47 -0600 5. Received: from [203.199.83.28] (helo=rediffmail.com) 6. by arjuna.banijya.com with smtp (Exim 4.43) 7. id 1CPaev-00057f-8T 8. for info@infobanc.com; Wed, 03 Nov 2004 23:59:45 -0600 9. Received: (qmail 28471 invoked by uid 510); 4 Nov 2004 05:59:09 -0000 10. Date: 4 Nov 2004 05:59:09 -0000 11. Message-ID: <20041104055909.28468.qmail@webmail18.rediffmail.com> 12. Received: from unknown (61.3.251.11) by rediffmail.com 13. via HTTP; 04 nov 2004 05:59:08 -0000 14. MIME-Version: 1.0 15. From: "Raj International " rajxyz@rediffmail.com 16. Reply-To: "Raj International " rajxyz@rediffmail.com 17. To: "InfoBanc" info@infobanc.com 18. Subject: Thanks for activation

I have added line numbers for clarity and help in discussion - you will not see such line numbers in actual e-mail heading.

Explanation of Header Elements

If you look carefully at e-mail header above, a pattern is clearly visible. The header is composed of several lines of text - each starting with header name (e.g. Delivery-date) , a colon (:), a space and finally header value. If a line starts with a tab or spaces (line nos. 2-4 and 5-8) - that line is a continuation of the previous header value line. So, the header name 'Received:' in line 2 has a header value that spans lines 2 to 4.

Some of the header names are simple and self-explanatory, such as the 'Delivery-date:', 'From:', 'Reply-To:, 'Subject:' etc. For example, sender's e-mail address appears after header name 'From:' and the recipients e-mail address appears after the 'To:' header name.

Please note - mail servers have no way to check if the sender is using his or her own e-mail address. This lack of verification is a weakness - that spammers and fraudsters use ruthlessly to confuse recipients. So, do not accept sender's e-mail address at face value. A fraudster or spammer, in all likelihood, will never use his/her actual e-mail address. Instead, he/she may use a legitimate e-mail address (it could even be your own e-mail) as sender.

We shall not discuss each and every header name - as many of these can be forged or a fake one inserted by spammer. What is most important for our purpose (and most difficult to forge) is the 'Received:' headers. Analysis of 'Received:' header names can reveal a great deal of information about the sender.

We shall discuss how to analyze the Received header and locate sender's country in next issue.