Find out where an email originated from?

[BigToque]

How do you go about doing this with the header information in an email?

A friend sent me a message and I'm trying to find out where in the country he was when he sent the message.

--------------------------------------------------

Return-Path: <xxxxxx@hotmail.com>
Received: from mh8-sfba.mail.home.com ([24.0.95.237])
by femail47.sdc1.sfba.home.com
(InterMail vM.4.01.03.20 201-229-121-120-20010223) with ESMTP
id <20010810162349.OSBN25288.femail47.sdc1.sfba.home.com@mh8-sfba.mail.home.com>
for <ssstefan@mail.cky1.mb.wave.home.com>;
Fri, 10 Aug 2001 09:23:49 -0700
Received: from mx8-sfba.mail.home.com (mx8-sfba.mail.home.com [24.0.95.233])
by mh8-sfba.mail.home.com (8.9.3/8.9.0) with ESMTP id JAA10314
for <ssstefan@home.com>; Fri, 10 Aug 2001 09:23:48 -0700 (PDT)
Received: from hotmail.com (f142.law4.hotmail.com [216.33.149.142])
by mx8-sfba.mail.home.com (8.11.1/8.11.1) with ESMTP id f7AGNmj13463
for <ssstefan@home.com>; Fri, 10 Aug 2001 09:23:48 -0700 (PDT)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Fri, 10 Aug 2001 09:23:48 -0700
Received: from 24.78.91.246 by lw4fd.law4.hotmail.msn.com with HTTP; Fri, 10 Aug 2001 16:23:48 GMT
X-Originating-IP: [24.78.91.246]
From: <xxxxxx@hotmail.com>
To: ssstefan@home.com
Subject: Here's the deal....
Date: Fri, 10 Aug 2001 16:23:48
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <F142bpH71yEXUIEAOeI00005c55@hotmail.com>
X-OriginalArrivalTime: 10 Aug 2001 16:23:48.0822 (UTC) FILETIME=[D5D3EF60:01C121B8]

 

[Ender78]

Taking a look at this field : X-Originating-IP: [24.78.91.246]
States that this person was in Vancouver,Canada.

Host name: h24-78-91-246.vc.shawcable.net
IP address: 24.78.91.246
Alias(es): None

 

[BigToque]

thanks!

Did you use tracert? I forgot to try that 😱

 

[Ender78]

No I used nslookup on the IP that I saw, X-Originating IP.