Email header sleuth...
 

MegaSack DRAW - 6pm Christmas Eve - LIVE on our YouTube Channel

Email header sleuths

22 Posts
12 Users
0 Reactions
148 Views
 lerk
Posts: 185
Free Member
Topic starter
 

Is it possible to tell if the origin of two emails from different addresses is actually the same pc/internet connection?

I’ve just received an email purportedly from a legal firm but have reason to believe that it may actually be from someone who I am already in dispute with.

Both btinternet.com addresses and the writing style and content would suggest this is the case, but if it can be proven that the sender is the same it would be great.


 
Posted : 14/08/2022 5:17 pm
Posts: 3362
Full Member
 

You can try pasting  the header into somewhere like this..

https://dnschecker.org/email-header-analyzer.php


 
Posted : 14/08/2022 5:22 pm
Posts: 10326
Full Member
 

If they have used webmail then it can be very difficult to tie down.  There are various tools online that can help but if they have just set up another btinternet.com address online then you are probably a bit stuck

Messageheader (googleapps.com)


 
Posted : 14/08/2022 5:23 pm
Posts: 0
Free Member
 

They’re going to be a high end law firm using a @btinternet.com email address. Be careful 😉


 
Posted : 14/08/2022 5:33 pm
Posts: 12872
Free Member
 

Can’t hurt to try! If they’re from a mail client on the same local network, it’ll be pretty obvious unless they’ve taken steps to hide it. If they’ve used webmail then, as above, don’t think there’s any way to tell.


 
Posted : 14/08/2022 5:36 pm
 lerk
Posts: 185
Free Member
Topic starter
 

Yes I’ve not been able to find any sort of internet presence for the business either.

It gives an address showing it is based in the same building as the guy who I think has written the email/letter.

And the official legal letter has been sent as a docx rather than a pdf…

I’m just firing up my pc to have a look at the headers now as iOS won’t show me them.


 
Posted : 14/08/2022 5:43 pm
Posts: 7751
Free Member
 

So the purported legal firm doesn't have an internet presence and they've emailed you on a weekend?
Some suggestions...
- check companies house website to see if business name exists.
- respond to email requesting details of their licence to practice.
- call the Solicitors Regulatory Authority (SRA) to ask if the purported legal firm exists; if not, they may take a dim view of a private individual behaving like this.
- ask SRA to confirm their response by email
- forward SRA email response (if they send one) to purported legal firm and the other party

If SRA confirm legal firm doesn't exist, contact police to request they contact the other party in your dispute to warn about their behaviour.


 
Posted : 14/08/2022 6:01 pm
 lerk
Posts: 185
Free Member
Topic starter
 

Oh yes, it smells fishier than a bucket of month old haddock!
Some suggestions…
– check companies house website to see if business name exists. IT DOESN'T
– respond to email requesting details of their licence to practice. HAVE DONE ALREADY (it could be that he's acting as a lawyer rather than a solicitor - but I don't really think that is much better...)
– call the Solicitors Regulatory Authority (SRA) to ask if the purported legal firm exists; if not, they may take a dim view of a private individual behaving like this. I'VE ALREADY FORWARDED THE EMAIL TO THEIR REPORTING LINE
– ask SRA to confirm their response by email
– forward SRA email response (if they send one) to purported legal firm and the other party

Onto sleuthing matters...

Received: from host86-142-60-xxx.range86-xxx.btcentralplus.com ([86.142.60.xxx] helo=DESKTOP3RT5xxx)

Am I right in thinking that this is the PC name that the email was sent from?
It is at the start of the header trail (working up from the bottom) and matches another email from him...


 
Posted : 14/08/2022 6:11 pm
Posts: 15227
Full Member
 

btinternet.com email addys are just free personal email adresses that you get if you are a BT internet customer, so it could litterally be anyone, although I think we may have an idea!

That really says it all. Save the email as evidence of bulshittery.

Would you respond to a 'legal firm' with a yahoo.com email?... nope. same applies here.


 
Posted : 14/08/2022 6:29 pm
Posts: 0
Free Member
 

If it’s been saved as a docx, there’s a reasonable chance that the properties show the name of the author.


 
Posted : 14/08/2022 6:31 pm
Posts: 4191
Free Member
 

Received: from host86-142-60-xxx.range86-xxx.btcentralplus.com ([86.142.60.xxx] helo=DESKTOP3RT5xxx)

Am I right in thinking that this is the PC name that the email was sent from?

Probably. The sequence does work up from the bottom. helo=DESKTOP3RT5xxx suggests it's a computer that was part of a managed network but sending direct from a btcentral IP address, not a company server, suggests it's now not part of network.


 
Posted : 14/08/2022 6:35 pm
Posts: 15227
Full Member
 

Careful now... Don't open or save any attachments..just archive the email.
I suspect the offending party is not that sophisticated due to the above. But you should absolutely *never* open attachments from unsolicited or potentially dangerous emails.


 
Posted : 14/08/2022 6:36 pm
 lerk
Posts: 185
Free Member
Topic starter
 

cezza168
Free Member
If it’s been saved as a docx, there’s a reasonable chance that the properties show the name of the author.

You beauty...
Game, Set and Match!


 
Posted : 14/08/2022 6:46 pm
Posts: 15227
Full Member
 

Stop right there, read my post above, please.


 
Posted : 14/08/2022 6:47 pm
Posts: 0
Free Member
 

It’s a criminal offence to purport to be a solicitor without being registered as one. A quick check of the SRA / solicitors register will determine if the person / firm is real - and if not a call to the local police would be a sensible next step.


 
Posted : 14/08/2022 7:03 pm
 lerk
Posts: 185
Free Member
Topic starter
 

mattyfez
Free Member
Stop right there, read my post above, please.

Thanks for the attempt Matty, I'd already opened it well before your post though.
Amateur I know.

You're right though - he wouldn't have a clue how to do anything nefarious even if he wanted to.

I'm just sending an update to the SRA - it should be a walk in the park for them!


 
Posted : 14/08/2022 7:25 pm
Posts: 7751
Free Member
 

Game,set and match?
No.
You (may) have an advantage but you must now decide how to use it.
My earlier suggestion about reporting this to both the SRA and police still stands - as endorsed by cheddar above.
If you really wanted to force the issue you could contact his employer as you know which building he works in.
How significant is the dispute?
Reputational, financial?


 
Posted : 14/08/2022 7:26 pm
Posts: 12872
Free Member
 

You beauty…
Game, Set and Match!
that is hilarious 😆 his genuine personal details are embedded in the bogus document? What a numpty.


 
Posted : 14/08/2022 7:42 pm
Posts: 13764
Full Member
 

whats the story to all this then?


 
Posted : 14/08/2022 7:44 pm
 lerk
Posts: 185
Free Member
Topic starter
 

I can't really add any more detail at the moment - I'm just opening a small claim...

It makes a fantastic story though so once its done and dusted I'll tell the tale!


 
Posted : 14/08/2022 7:47 pm
Posts: 15227
Full Member
 

Oh maaaaan! This sounds like it could be truly hilarious.

It's not Donald trump you are having this dispute with, is it? 😀


 
Posted : 14/08/2022 8:07 pm
Posts: 11364
Full Member
 

I'm curious so assuming you'll be pm'ing the story, please add me to that list.


 
Posted : 14/08/2022 8:15 pm
Posts: 6898
Full Member
 

Yeah add me. Was gonna suggest document properties in Word but beaten to it. Fully patched PC and applications ought to be safe to open a document so long as you let Word keep it as ‘untrusted’ which email attachments and downloads are. Deffo don’t click on anything the document ’asks’ you to do - such a thing is active code that can do nefarious things.


 
Posted : 14/08/2022 8:22 pm