Tracing where emails are from

welnik

This is something I would love to do but it seems quite a mammoth task. I had a spoof email today which was supposed to have come from PAYPAL. The source code was

Message-Id: <E1DqGKV-0004ST-Eh@sago5.sago5.com>
Date: Wed, 06 Jul 2005 16:17:11 -0400
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - sago5.sago5.com
X-AntiAbuse: Original Domain - blueyonder.co.uk
X-AntiAbuse: Originator/Caller UID/GID - [99 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - sago5.sago5.com
X-Source: ‚†Ù
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: tv4rum.com:/public_html/massmail
X-Envelope-To: "obv my details"
Return-Path: nobody@sago5.sago5.com
X-OriginalArrivalTime: 06 Jul 2005 20:17:56.0874 (UTC) FILETIME=[CC2E0EA0:01C58267]

Are there any experts outthere that understand that lot or can explain it in layman's terms?

drlight_2

The adress has a french accent, english punctuation and a picture of a cross, I don't think the sender want's you to know where it came from. OE email properties source tells you where it came from, you posted a filter log