Yes the IP can be traced very easily.Has that person emailed you before?if yes then you could look at the header of the message and this will tell you most of the story.here's what i got for you:
Received: from alpha.netvision.net.il (alpha.netvision.net.il [194.90.1.13]) by cmx.netvision.net.il (8.9.3/8.9.3) with ESMTP id CAA15313 for
victim@victim.com>; Sat, 10 Jul 1999 02:49:59 +0300 (IDT)
From:
bgates@microsoft.com
Received: from some.hostname.crap.com (some.hostname.crap.com [62.0.146.225]) by alpha.someone.com (8.9.3/8.8.6) with SMTP id CAA15313 for
victim@victim.com; Sat, 10 Jul 1999 02:55:46 +0300 (IDT)
Date: Sat, 10 Jul 1999 02:55:46 +0300 (IDT)
Message-ID: <199907092355.
CAA15313@alpha.someone.com>
X-Authentication-Warning: alpha.someone.com: some.hostname.crap.com [62.0.146.225] didn't use HELO protocol
Subject: Fake mail
Status:
X-Mozilla-Status: 8001
X-Mozilla-Status2: 00000000
X-UIDL: 3752da3b000002ff
Yeehaw! Look at all those numbers and letters and shiny things!
Let's start from the top, shall we?
Received: from alpha.someone.com (alpha.someone.com [194.90.1.13]) by cmx.someone.com (8.9.3/8.9.3) with ESMTP id CAA16970 for >; Sat, 10 Jul 1999 02:49:59 +0000 (GMT)
Okay, so the mail was received from alpha.someone.com (alpha.someone.com [194.90.1.13]). What does that mean?
A quick checkup on InterNIC(25)'s databases (type 'whois alpha.someone.com' without the quotes on a Unix system or download SamSpade for Windows at
www.samspade.org) reveals that it is owned by someone.com. This is probably some kind of a sub-server they use to send mail. Let's leave it alone, it's not important to us right now. The (alpha.someone.com [194.90.1.13]) part shows you the hostname(10) and the IP address (9) of the server the Email was sent from.
Ooh, ooh, wait! Wasn't the mail supposed to be sent from microsoft.com? I mean, the sender is
bgates@microsoft.com!
If we did the mail forging thing on microsoft.com instead of on someone.com this wouldn't have happened, now would it? It would have seemed like an ordinary Email... from Bill Gates... well, at least so far.
Anyway, the rest is just the MID (which we will get to later) and the date of the message (the sending date) according to the server which the message was sent from. The +0000 (GMT) part means that it was sent from the Greenwich time zone. If it was sent, for example, from the +0200 time zone it would have meant that this time zone's time is actually Greenwich time plus 2 hours. Find our your time zone first so you'll be able to switch time zones and find out when was the message sent in your time.
Now, on to more important things.
From:
bgates@microsoft.com
Well, I guess this line is obvious... let's move on.
Received: from some.hostname.crap.com (some.hostname.crap.com [62.0.146.225]) by alpha.someone.com (8.9.3/8.8.6) with SMTP id CAA15313 for
victim@victim.com; Sat, 10 Jul 1999 02:55:46 +0300 (IDT)
Okay, now this is really interesting. Now we get the sender's hostname and IP address.
Note about the hostname: a dial-up(31) user will have a long and twisted hostname. For example: my hostname right now (at least when I was writing these lines) is RAS4-p97.hfa.netvision.net.il. Netvision.net.il is my ISP, and the rest is mostly crap (pay close attention to the hfa thing. Hfa stands for Haifa, which is my home town. It means that I'm connected through Netvision's Haifa server. See? Hostnames can be interesting).
You must have noticed by now that the hostname we got is certainly not from microsoft.com, and that the mail server who sent this isn't exactly microsoft.com or a microsoft sub-domain(26) either, which clearly shows that this Email is completely fake.
Another note about the hostname: sometimes you might not get a hostname, but you will always get an IP address. You can find the IP's hostname (most IP addresses do have a hostname) by doing 'nslookup ip-address' without the quotes on a Unix system or going to
http://www.samspade.org and using their DNS(17) Lookup Tool. If you still can't get it, try doing a whois.
To overcome this problem, you need to do two things:
1) Send this mail from Microsoft's Sendmail server.
2) Send this mail from an account that is connected to the web through Microsoft. If you can't get one, it will clearly show in the headers that the mail wasn't sent from Microsoft.
Note: nice trick to pull on someone: if your ISP is blah.com, you can send your friends an Email from
admin@blah.com which will look 100% authentic!
bye!