8

Someone is trying to fool me. They are sending mails to me and I'm pretty sure it is someone I know.

Via "Show original message" I found the IP address of the sender. With the assumption it is someone I know (he/she is just using another email account) I assume he/she has sent me other mails under his normal account.

In this case the IP address of the PC will be the same.

Unfortunately it is not easy to go through more than 500K mails and see if the IP address is the same.

The search of Gmail does not search the headers. Is there a way to search all mails received in Gmail for a particular IP address?

Improve this question
2
  • 2
    You are not getting the user's ip address, Google does not place that information in the header of the email, what you see is the ip address of Google.
    – Ramhound
    Commented Mar 19, 2012 at 13:04
  • 1
    @Ramhound maybe, but it depends which email client the person sending the email used. If they used gmail, then you are correct. If they used other email client/server - there would be much more info on the email headers. Wim - check the headers and see where the Received headers trail starts from first.
    – Yoav Aner
    Commented Mar 19, 2012 at 13:30

2 Answers 2

Reset to default
6

Perhaps Gmail doesn't let you search the email headers from their web interface, but you should be able to access all email messages via POP/IMAP, and then you can use standard search tools (e.g. grep) to search for anything you want.

However, see the comment above from Ramhound and myself—the email headers might lead you back to Gmail itself, which won't reveal much about the originator of the email. Also, all headers are easy to forge anyway. If the user is clever enough, they can generate whichever headers / source IPs they want.

If in your case the user you're trying to spy on / trace isn't malicious, then you might be able to get at least some information other than the message content from email headers.

Improve this answer
2
  • 3
    +1. Google doesn't appear to index email headers, so searching yourself is probably necessary. I'd suggest getmail + grep in linux. Also IP addresses from home ISPs likely change on a timescale of ~1 month (IPs from mobile phones more rapidly). I'd also suggest running a whois on the IP (whois 123.123.123.123), reverse DNS (dig -x 123.123.123.123), etc to see if it gives any identifying info.
    – dr jimbob
    Commented Mar 19, 2012 at 14:08
  • Thanks for the added info @drjimbob. Spot-on comments! I've also used imapsync which works quite well with gmail to retrieve emails to another imap mailbox (which can also be on gmail btw)... I didn't go down to the nitty-gritty on my answer however. Was just giving a high-level overview of what's possible.
    – Yoav Aner
    Commented Mar 19, 2012 at 14:20
6

By using OpenSSL you can access your inbox and easily parse the result via grep. Assuming you have a linux box available follow these simple steps:

Connect via SSL to GMail (tee output to a file):

openssl s_client -crlf -connect imap.gmail.com:993 | tee /tmp/mail-headers.txt

Once connected you need to login with your username and application specific password: 

tag login [email protected] password
tag login [email protected] apppassword

The application password can be generated in your GMail's preferences menu.

With the prefered inbox (folder) type in the following command to see the the number of messages in the folder. 

tag STATUS INBOX (MESSAGES)

Example output: 

* STATUS "INBOX" (MESSAGES 3214)
tag OK Success

This tells me I have 3214 messages in the folder INBOX. Now I can write all the messages (including headers) out and store them as I wish. Issue the following commands to print all messages: 

tag SELECT INBOX
tag FETCH 1:3214 (BODY[HEADER])

The numbers are to specify I want to print message 1 through 3214.

Proceed with a logout: 

tag logout

Then you can grep through the output as you see fit like so:

grep '123.123.123.123' /tmp/mail-headers.txt

You may prefer to see context around the lines and page through them to find related Subject: headers too:

grep --color=always -C 10 '123.123.123.123' /tmp/mail-headers.txt | less -R
Improve this answer
1
  • Thanks for this answer! I was looking for an easy way to grep my email headers. One addition: I tried following the instructions as posted and got a tag BAD FETCH not allowed now. I found that I had to select the inbox first, and then the FETCH command worked: tag SELECT INBOX
    – TrinitronX
    Commented Dec 13, 2012 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.