header trace

redsun

New Email
hello,... i got email suppsoedly from the phillipines and after i did an email trace it shows coming from sunnvale usa, the sender denies fro m the usa and has no idea how this can be. cant here be a mistake,, i tired different tracing sites and they all tell me the same thing. thank you

its yahoo mail
 

Big Dan

EQ Forum Moderator
Sunnyvale is where Yahoo's headquarters are. You're probably grabbing the wrong IP. If he sent it through Yahoo mail it may show as originating from wherever Yahoo's server's are, I'd guess in Sunnyvale.
 

redsun

New Email
Hello,

If you post the full email headers from the Yahoo Mail we can help you figure it out.

:welcome: to Email Questions!


From rina panggreeeeete Sun Jun 19 07:48:23 2011
X-Apparently-To: miniriry@yahoo.ca via 98.136.183.40; Sun, 19 Jun 2011 00:48:24 -0700
Return-Path: <mistlitoijonifir@yahoo.com>
X-YahooFilteredBulk: 98.138.91.165
Received-SPF: none (domain of yahoo.com does not designate permitted sender hosts)
X-YMailISG: BmH2vYoWLDsGfrbHrKxouvrfjGTnu7kw9Q0GRcLo8s5hLu7e
Y2_vHvcg2ZESqXrlfNP_MejglYwlaPDvUkZQ10RAZUH8Hoxral3vtv6CI9CX
ekfcj643_oqK0DtAfNcb4f8_JP3SnQdt5j80aoL3EyD31PcuA5q8USSwbAE_
0nq5GYlzcnumBLDdel.GLyf0UrXm.i2K7H5UOPf4y73Hu40ViMohb7wpNw1H
qZLSTnIyVJ11YWISZJnGt5RlIVlZz_9ka9VlrzTLbTMPpHGiXdkQ1yh_mBjF
BL3u1Y1fwNQlv1.wycY2yFt_v8IqxLt2tacR.pLLJJJvmmFWvZlq6aQxgKpd
XQrrDHbF6ea_jZ9pAHm.9EZHKC.JH5g.175OnrSyTsOLK.HENfhFj4rViFGw
iVlA7jXLLruptWqmETDaqhK6ks.UKZCArYdvBd7ghLlyYowsS2.AoO8ny4Rr
7t06k7HvxzNXImy3Y.YdbtEfjT8F8E8N3OY2s5m.eINI.6DlOTlOOWq7lxqX
LMHTVhrbOWe5CH9F58G5hXeS3Hltr5zzR7TbiNIhDyx0vz7UblBfyTF5GBze
bd9nU4sIjyWnd6so_u7CiFFoEltG5TIHnjRa87OkHQ_b4NUH0T5v03lf_HbP
u09LnsiWeA0KkOYpiW6zJI11E5yvmrUjGlhKnxvBZl2OhyZ6KwsYwb52ZFRX
c4HcnrQi74aObL4IKqnnYVmlKeLxVZkAPLR4JBnwWPUsnyCiR95blllh1YRv
KiyBueKKuBtzcaV0pOfwpe_PuM.aT1Nhy4XL8QeQK.PXGDIPvmA5GRHfunhg
zwUB58ILSihPPfXbkRjg8PEMDmCm3dcStq8dWHHogOzxuuhROhL61fNe5PWw
m4a3FIWxROu521hr_zZ9bSwNckSweHEIMfxlp6jArDq88G2XaqSEcgOgyH6Y
t8egMgoLlgZkl_QaHIJyMHERhQokitMyRGmnyiC6xgwBJwXaEul88.k4dSLH
7pWQuC1GmzT_1AinRQ1JzzZtseAnJuI3_s7W2QnJguQj6XmyL8q7f8xa5S0W
5V6dgHIpEnK7fYdYsHCowWlQ7u3UW8ZmJFM-
X-Originating-IP: [98.138.91.165]
Authentication-Results: mta156.mail.ac4.yahoo.com from=yahoo.com; domainkeys=pass (ok); from=yahoo.com; dkim=pass (ok)
Received: from 127.0.0.1 (HELO nm5-vm4.bullet.mail.ne1.yahoo.com) (98.138.91.165)
by mta156.mail.ac4.yahoo.com with SMTP; Sun, 19 Jun 2011 00:48:24 -0700
Received: from [98.138.90.51] by nm5.bullet.mail.ne1.yahoo.com with NNFMP; 19 Jun 2011 07:48:23 -0000
Received: from [98.138.89.166] by tm4.bullet.mail.ne1.yahoo.com with NNFMP; 19 Jun 2011 07:48:23 -0000
Received: from [127.0.0.1] by omp1022.mail.ne1.yahoo.com with NNFMP; 19 Jun 2011 07:48:23 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 624280.47906.bm@omp1022.mail.ne1.yahoo.com
Received: (qmail 1909 invoked by uid 60001); 19 Jun 2011 07:48:23 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1308469703; bh=hpHz/ITk+PQ4IsWmYeO+nRPxUema9l837ROuYT8r6sQ=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=4k+1B51SXP7IlkbqsTLJzD9TyQkEsZutr8SXVDrTECGFDZU7G1P6Gma3ho8sn368wU2gODwOaOeGl5n42rhlRkdaUpfixleOGxwcRaQZCfPOcD+Z9Fzu8EggU/Fz54b3vN5oumyFftAOUOvZoJTE3jRq0KA+zUyLC/l2zSSKYp4=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
b=DNmIF6wXYK3VmrxZdRCRAHGq68iVXO72liGgYu15HvpKDRdnz6gCmg26K70LsauWgaeTkHT/p5HMBtJo8Vc5U/Wfctqpc3joQvktEr18OJ5fnXrK/t5THvmOc6f2C5LApZjVFN6rpMOEWpvLOqJNrFOhSuj5s3pm9IP5L+vk+aw=;
Message-ID: <485281.1585.qm@web126006.mail.ne1.yahoo.com>
X-YMail-OSG: TP_h3AYVM1nVe3VIrzS0hfUUf7FnPufUEnqfBL3_MBEbRLV
SlSnBTenm8QSEsfobmbLDLGn8eoYwfahxrZGZjVzpBgW4nxwRB33hoF0oupv
YL9W.G5_38hjaTx8S13KRKr.5AQpK6H4czipmFrlR8fvYbsXcFoyuqZNCuAY
wEoCRSPh_NuAwm0PUxiVv6IHPHsDNknRxGhsQFEeIGKLtoJZhhhtse4zcO9u
ubXX3G_Jn..B4lYXBIbmL1LoVR3KKTsqn4WqiJHURWDvFKdnja_g_Cv1ereA
rRKm0GiN102v5dHhMLMpfDTj6XmBsAjTWyGv_x58f9Zm56jXBDuaYY17K25w
pbTPux4lEtACigLR7QrEgN4p9zjtjZmxqND7jRfoCZorUbw--
Received: from [98.138.83.203] by web126006.mail.ne1.yahoo.com via HTTP; Sun, 19 Jun 2011 00:48:23 PDT
X-Mailer: YahooMailRC/570 YahooMailWebService/0.8.111.304355
Date: Sun, 19 Jun 2011 00:48:23 -0700 (PDT)
From: rina panggreeeeete <mistlitojonifir@yahoo.com>
Subject: how are u?
To: Larry Kelp <muniriry@yahoo.ca>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1676102550-1308469703=:1585"
Content-Length: 2281

thanks
 

EQ Admin

EQ Forum Admin
Staff member
That's odd, the sender appears to be connecting from 98.138.83.203 which is indeed a Yahoo IP address.

From: rina panggreeeeete <
newreply.php
>
Subject: how are u?

That looks pretty darned scammy. I hope they are not asking for money. Be careful!
 

EQ Admin

EQ Forum Admin
Staff member
I doubled checked sending from my Yahoo account and my home IP address still shows up as the sender. There doesn't appear to be an issue with the Yahoo mail servers getting the correct IP address into the headers. I'll check around and find out what cases would cause a Yahoo IP to show up as the sender.
 

redsun

New Email
I doubled checked sending from my Yahoo account and my home IP address still shows up as the sender. There doesn't appear to be an issue with the Yahoo mail servers getting the correct IP address into the headers. I'll check around and find out what cases would cause a Yahoo IP to show up as the sender.



ok thanks a lot,,,and if its yahoo mail wont it show as yahoo ip ? they said a 'friend" made up the email so i wondered if a "friend" set it up in the usa for them,... strange
 
Top