Final Warnings
Please pay attention to these warnings when attempting to track email messages:
A) Host Names vs IP Addresses: Always base your tracking decisions based upon the IP Addresses that you find in the header information and not on host names (which are a lookup from the IP Address anyway). Because mapping an IP Address into a host name and then back into an IP Address may yield a different IP Address.
B) False Header Information: Be aware that spammers may try to insert fake Received: header lines into the Internet Headers of the email message to confuse you. Just follow the trail through the Received: header fields from mail server to mail server and use some common sense when the information makes no sense.
C) False IP Address: The IP Address that you finally end up at is the IP Address of the computer that sent the email. But is that computer the real sender, or a computer that was broken into, so that a false email could be sent. Or the sender could try to hide behind an 'anonymizer' service -- where you will get to the IP Address of the 'anonymizer' company.
D) IP Addresses Change: Do not assume that the sender's computer has a fixed, constant IP Address. This may be true in some cases, but most people who dial into the Internet almost always get a different IP Address each and every time they connect into the Internet. However, all is not lost. Many times you can report the IP Address and full email Internet Headers (which many times contain time-of-day information) to the person's ISP and the ISP can track this down to a unique end-user (by examining login and logout logs) and take action.
E) Viruses: Do not assume the worst of the person sending the email. They may have just been infected with a virus, which is using a person's computer to spread itself.
F) Open Mail Servers: Do not assume the worst of the company whose mail server was used to send the original email. They may be involved in the spam, but they also may just have a misconfigured email server, which is allowing a spammer to send the email through their mail server. |
