Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Someone is trying to fool me. They are sending mails to me and I'm pretty sure it is someone I know.

Via "Show original message" I found the IP address of the sender. With the assumption it is someone I know (he/she is just using another email account) I assume he/she has sent me other mails under his normal account.

In this case the IP address of the PC will be the same.

Unfortunately it is not easy to go through more than 500K mails and see if the IP address is the same.

The search of Gmail does not search the headers. Is there a way to search all mails received in Gmail for a particular IP address?

share|improve this question

migrated from security.stackexchange.com Mar 19 '12 at 19:26

This question came from our site for Information security professionals.

2  
You are not getting the user's ip address, Google does not place that information in the header of the email, what you see is the ip address of Google. –  Ramhound Mar 19 '12 at 13:04
    
@Ramhound maybe, but it depends which email client the person sending the email used. If they used gmail, then you are correct. If they used other email client/server - there would be much more info on the email headers. Wim - check the headers and see where the Received headers trail starts from first. –  Yoav Aner Mar 19 '12 at 13:30

2 Answers 2

Perhaps Gmail doesn't let you search the email headers from their web interface, but you should be able to access all email messages via POP/IMAP, and then you can use standard search tools (e.g. grep) to search for anything you want.

However, see the comment above from Ramhound and myself—the email headers might lead you back to Gmail itself, which won't reveal much about the originator of the email. Also, all headers are easy to forge anyway. If the user is clever enough, they can generate whichever headers / source IPs they want.

If in your case the user you're trying to spy on / trace isn't malicious, then you might be able to get at least some information other than the message content from email headers.

share|improve this answer
2  
+1. Google doesn't appear to index email headers, so searching yourself is probably necessary. I'd suggest getmail + grep in linux. Also IP addresses from home ISPs likely change on a timescale of ~1 month (IPs from mobile phones more rapidly). I'd also suggest running a whois on the IP (whois 123.123.123.123), reverse DNS (dig -x 123.123.123.123), etc to see if it gives any identifying info. –  dr jimbob Mar 19 '12 at 14:08
    
Thanks for the added info @drjimbob. Spot-on comments! I've also used imapsync which works quite well with gmail to retrieve emails to another imap mailbox (which can also be on gmail btw)... I didn't go down to the nitty-gritty on my answer however. Was just giving a high-level overview of what's possible. –  Yoav Aner Mar 19 '12 at 14:20

By using OpenSSL you can access your inbox and easily parse the result via grep. Assuming you have a linux box available follow these simple steps:

Connect via SSL to GMail (tee output to a file):

openssl s_client -crlf -connect imap.gmail.com:993 | tee /tmp/mail-headers.txt

Once connected you need to login with your username and application specific password:

tag login user@gmail.com password
tag login user@gmail.com apppassword

The application password can be generated in your GMail's preferences menu.

With the prefered inbox (folder) type in the following command to see the the number of messages in the folder.

tag STATUS INBOX (MESSAGES)

Example output:

* STATUS "INBOX" (MESSAGES 3214)
tag OK Success

This tells me I have 3214 messages in the folder INBOX. Now I can write all the messages (including headers) out and store them as I wish. Issue the following commands to print all messages:

tag SELECT INBOX
tag FETCH 1:3214 (BODY[HEADER])

The numbers are to specify I want to print message 1 through 3214.

Proceed with a logout:

tag logout

Then you can grep through the output as you see fit like so:

grep '123.123.123.123' /tmp/mail-headers.txt

You may prefer to see context around the lines and page through them to find related Subject: headers too:

grep --color=always -C 10 '123.123.123.123' /tmp/mail-headers.txt | less -R
share|improve this answer
    
Thanks for this answer! I was looking for an easy way to grep my email headers. One addition: I tried following the instructions as posted and got a tag BAD FETCH not allowed now. I found that I had to select the inbox first, and then the FETCH command worked: tag SELECT INBOX –  TrinitronX Dec 13 '12 at 17:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.