Tracking the origin of an email

Especially Hotmail and other free email accounts

[Bobby]

Is it possible to know where an email originates from? Like what country for example?

I ask this because there are plenty of free email services like Hotmail and Yahoo but it isn't clear to me how to figure out where the email is originating from (local IP address and country).

I check the properties of the email in Outlook Express and find various "Received: from" addresses, I assume it is the last one.

Any ideas?

[blacknight]

You should be able to check the sending IP address in the header.

[semiprofessional]

IF there is an X-Originating-IP you can trace the IP to the ISP that that person used to compose the email.

Some of them have their own spam/abuse tracking codes that only allow them to see where the user was coming from. In that case, you will only be able to see the route back to the email host.

spamcop.net does a reasonable job of working out who really sent an email.

[Bobby]

Thanks for your responses.
Semiprofessional, here is what I read from the properties of the email. This one happens to be a yahoo account.

Received: from web26402.mail.ukl.yahoo.com (web26402.mail.ukl.yahoo.com [217.146.176.26])
by adhara-ng.e4a.it (Postfix) with SMTP id 27E6DAEC045
for <MyEmailAddress.com>; Fri, 19 Nov 2004 18:59:48 +0100 (CET)
Received: (qmail 69973 invoked by uid 60001); 19 Nov 2004 17:59:59 -0000
Message-ID: <[e-mail]>
Received: from [80.179.251.92] by web26402.mail.ukl.yahoo.com via HTTP; Fri, 19 Nov 2004 17:59:58 GMT
Date: Fri, 19 Nov 2004 17:59:58 +0000 (GMT)

Where would I look to locate the country of origin?
It appears that the originating IP is:
80.179.251.92

When I perform an IP lookup I get the same information as other free email accounts like hotmail etc.

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL

They can't all be from Amsterdam!
How can I pin it down?

[idoc]

You can look up those i.p.'s at: [ripe.net...]

Really though it is a *whole* lot less frustrating provided you admin your own server to block email from the domain and be done with it. For a linux sever, for example you would just need to add this to /etc/mail/access as follows:

.ukl.yahoo.com 550 .ukl.yahoo.com domains disallowed

and etcetera... take them out one by one as need be. You can't control the noc's at the other end to do the right thing, you can control your server. ;)