IP ... em e-mails indesejádos

[Fingolfin]

Ae galera...

é um tópico de consulta...

Quem nunca recebeu aquele e-mail chato sem destinatário... ou alguém q vc não sabe quem tá te enviando virus?

Bom... eu tentei verificar o IP da pessoa... mas aí entra um probleminha... qdo clicamos no Outlook em Propriedades/Detalhes naquele e-mail... temos uma mensagem q é mais ou menos assim:

Return-Path: <tidoluma@hotmail.com>
Received: from riolf50.globoi.com (10.10.182.14) by
mail.globo.com (6.0.053)
id 3FB1D1100106C3E1 for mpepino@globo.com;
Sat, 3 Jan 2004 00:18:15 -0200
Received: from localhost (localhost.localdomain
[127.0.0.1])
by riolf50.globoi.com (Postfix) with ESMTP id
9822D400E86
for <mpepino@globo.com>; Sat, 3 Jan 2004 00:18:14
-0200 (EDT)
Received: from riolf50.globoi.com ([127.0.0.1])
by localhost (riolf50 [127.0.0.1]) (amavisd-new, port
10024) with ESMTP
id 10486-37 for <mpepino@globo.com>; Sat, 3 Jan 2004
00:18:14 -0200 (EDT)
Received: from hotmail.com
(bay10-dav62.bay10.hotmail.com [64.4.37.236])
by riolf50.globoi.com (Postfix) with ESMTP id
AF0C040172C
for <mpepino@globo.com>; Sat, 3 Jan 2004 00:18:12
-0200 (EDT)
Received: from mail pickup service by hotmail.com with
Microsoft SMTPSVC;
Fri, 2 Jan 2004 18:18:11 -0800
Received: from 200.161.219.122 by
bay10-dav62.bay10.hotmail.com with DAV;
Sat, 03 Jan 2004 02:18:11 +0000
X-Originating-IP: [200.161.219.122]
X-Originating-Email: [tidoluma@hotmail.com]
X-Sender: tidoluma@hotmail.com
Reply-To: "Te amo Ma" <tidoluma@hotmail.com>
From: "Te amo Ma" <tidoluma@hotmail.com>
To: "Marluce Pepino" <mpepino@globo.com>
References: <000801c3d0cc$50d136e0$e2e1fea9@marluce>
<BAY10-DAV54mnFDHwu70000a42d@hotmail.com>
<001701c3d199$abb25b20$2e78fea9@marluce>
<BAY10-DAV25muFlSQyR0000a72d@hotmail.com>
<002901c3d19b$830fe960$2e78fea9@marluce>
<BAY10-DAV26S0qvtKQd0001e04d@hotmail.com>
<003701c3d19c$a716d2a0$2e78fea9@marluce>
<BAY10-DAV5qlRxBdKxd0000a6a2@hotmail.com>
<004101c3d19d$b3695040$2e78fea9@marluce>
<BAY10-DAV22N39x6HHG0001e018@hotmail.com>
<004b01c3d19e$4b48b540$2e78fea9@marluce>
<BAY10-DAV527KKQpQq50000a655@hotmail.com>
<005901c3d19f$08a45ae0$2e78fea9@marluce>
Subject: Re: Em casa
Date: Sat, 3 Jan 2004 00:15:49 -0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_00C9_01C3D18E.BDE0E6A0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE
V6.00.2800.1165
Message-ID: <BAY10-DAV62N6MB8eCW0001e18b@hotmail.com>
X-OriginalArrivalTime: 03 Jan 2004 02:18:11.0332 (UTC)
FILETIME=[D5CA5C40:01C3D19F]


As vezes temos uma variação... com alguns campos diferentes como:

Return-Path: <itner@terra.com.br>
Delivered-To: mpepino@globo.com
Received: from riolf50.globoi.com (10.10.182.14) by
mail.globo.com (6.0.053)
id 3FD699BE000B9BAA for mpepino@globo.com;
Thu, 11 Dec 2003 20:10:13 -0200
Received: from localhost (localhost.localdomain
[127.0.0.1])
by riolf50.globoi.com (Postfix) with ESMTP id
9966340681B
for <mpepino@globo.com>; Thu, 11 Dec 2003 20:10:05
-0200 (EDT)
Received: from riolf50.globoi.com ([127.0.0.1])
by localhost (riolf50 [127.0.0.1]) (amavisd-new, port
10024) with ESMTP
id 09130-20 for <mpepino@globo.com>; Thu, 11 Dec 2003
20:10:05 -0200 (EDT)
Received: from ivoti.terra.com.br (ivoti.terra.com.br
[200.176.3.20])
by riolf50.globoi.com (Postfix) with ESMTP id
1C20E406204
for <mpepino@globo.com>; Thu, 11 Dec 2003 20:10:05
-0200 (EDT)
Received: from sucre.terra.com.br (sucre.terra.com.br
[200.176.3.37])
by ivoti.terra.com.br (Postfix) with ESMTP id
6BE9E79C629
for <mpepino@globo.com>; Thu, 11 Dec 2003 20:10:13
-0200 (BRST)
Received: from terra.com.br (cedro.terra.com.br
[200.176.3.186])
(authenticated user itner)
by sucre.terra.com.br (Postfix) with ESMTP id
67F673C04A
for <mpepino@globo.com>; Thu, 11 Dec 2003 20:10:13
-0200 (BRST)
Date: Thu, 11 Dec 2003 19:10:13 -0300
Message-Id:
<HPR491$4C9B69994E33FA37669D6784E5ADCB9B@terra.com.br>
Subject: =?iso-8859-1?Q?Re:_Re:Cel?=
MIME-Version: 1.0
X-Sensitivity: 3
Content-Type: multipart/alternative;
boundary="_=_XaM3_Bdry.1071180613.2A.419179.42.11465.52.42.1010.590263986"
From: "=?iso-8859-1?Q?Jos=E9_Carlos_=CDtner?="
<itner@terra.com.br>
To: "=?iso-8859-1?Q?mpepino?=" <mpepino@globo.com>
X-XaM3-API-Version: 3.2 R28 (B53 pl3)
X-type: 0
X-SenderIP: 200.161.218.151

Então... como, no meio desse mundo de informações e vários IPs descobrimos qual é o IP da pessoa que nos enviou este e-mail?

E isto funciona mesmo se esta usar um webmail público?(tipo Yahoo ou Hotmail)

 

[Deriel]

Se a pessoa usou um hotmail ou algo semelhante, o que te interessa são os campos X-Sender-IP ou X-Originating-IP.

Se não existem esses campos, você vai precisar olhar a barafúndia de campos "Received" pois eles mostrama rota real que o e-mail teve até chegar ao seu provedor. Nesse caso o quen te interessa é o último dos campos "Received" (que é o IP de origem do e-mail).