[TriLUG] OT: Email Trace

[Tanner Lovelace]

jsevans at nc.rr.com wrote:

> I think that I have been involved in a penpal scam, and I would like to verify this before I contact the police.  I had exchanged several emails with a person in the UK who now wants me to send them money in Africa, to an undisclosed location.  Sounds fishy, huh?  I am trying to find out which part of the email header has the originating IP address.  I believe that the correct header is listed as:
> 
> X-Originating-IP:
> 
> I just want to make sure.  Thanks for you help.
> 
> Jason
> 

Note that all headers starting with X-[...] are officially
"user-defined" headers.  However, this particular one is used
quite a bit, but it is by no means guaranteed to be there.

Cheers,
Tanner