Source-T
Tracing Email Origin
Introduction
The Problem
From a reliable source, 91% of all cyber attacks either begin or are involved with a phishing email ( Source ). Moreso, a recent research finding indicated that most scammers lie about their location primarily to avoid being tracked and also, to create a false persona that will support their fraudulent activity.
In cases of harassment, defamation, or fraud, tracing the origin of an email can be critical in providing evidence for legal proceedings. It helps establish the sender’s location, identity, or intention behind the email, making it easier to track down malicious actors.
The Solution
Source-T is a solution that detects the source of an email by using the email headers. The email headers contain vital information like the sender’s IP address, which can help identify whether an email has come from a legitimate source or if it’s part of a malicious campaign.
Message-ID
A unique identifier for the email that can sometimes be used to track its origin. This can help identify whether the email was sent through a specific email service (e.g., Gmail, Yahoo, etc.).
SPF/DKIM Records
SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are security protocols that help verify if an email was actually sent from the domain it claims to be from. If these records are checked and found valid, it indicates the authenticity of the email. If not, it could suggest spoofing or phishing.
Why trace an email origin?
Verify Authenticity
Tracing an email’s origin helps confirm whether the email is truly from the sender it claims to be from. This is essential in identifying phishing attempts, impersonation, and spoofing, where cybercriminals attempt to deceive recipients into believing an email is legitimate.
Security and Fraud Prevention
Tracing this can help protect against identity theft, fraud, and cyber-attacks.
Spam Prevention
Many organizations track these to block suspicious addresses or domains, thereby preventing spam and potential security breaches.
Network or System Troubleshooting
If an organization’s network or system is being targeted, tracing the origin of an email can help IT administrators identify the source of the issue, whether it’s a breach attempt, a misconfigured system, or an attack.
Preventing Business Impersonation
In corporate environments, email spoofing is often used to impersonate high-level executives, trick employees into revealing sensitive information, or making fraudulent transactions. Tracing the origin of an email can help protect against these kinds of scams
Research and Investigations
In some situations, investigators or researchers need to trace the origin of emails to uncover details about a criminal activity or a cyber-attack. By analyzing the origin, they can uncover links between different attacks or identify patterns in cybercriminal activities.
By tracing the origin, you are essentially ensuring that emails are genuine, and you’re protecting yourself, your organization, and your digital assets from potential threats.
Differentiator
Detecting and displaying the source of incoming emails, and rejecting those sent via proxies with a request to resend without masking their origin
Source-T: Challenges and Antidotes
The Challenges
Source-T envisaged the Following Challenges
Spoofing
Sophisticated attackers can forge or alter email headers to hide the true origin, making tracing more difficult.
VPNs and Proxies
Some senders use VPNs, proxies, or anonymizing services to disguise their real IP address and location, making tracing more challenging.
Email Services
Major email providers like Gmail or Outlook often route emails through multiple servers, complicating tracing the exact source.
The Antidotes
Anti-spoofing Techniques
Implementing robust email authentication protocols like SPF and DKIM verifies the sender’s identity and prevents spoofed emails.
Use of WebRTC
WebRTC can bypass VPNs and reveal an actual IP address by establishing direct peer-to-peer connections.
Comprehensive Email Header Analysis
Analyzing “Received:” entries in email headers helps identify the actual IP & location of the sender.
Copyright © 2025