How to Trace an Email Back to Its Original ISP
Tracing an email address can help you find the location of the sender. However, the sender can utilize various tactics to mask the original location and even hide the Internet Service Provider used to send the email. If you can locate the real IP address of the sender, then you can find the ISP associated with that IP address.
1 Tracing Email
Email tracing often provides mixed results. While you may be able to locate the IP address of the sender of the email in some cases, if the sender uses a proxy or a virtual private network, or VPN -- or doesn't use the home network connection -- you won't get the actual IP address of the user. Only law enforcement officials can request records that can positively identify the sender of an email. However, even in the case of a subpoena to a VPN or proxy provider, there's still no absolute guarantee that you can locate the original ISP.
2 About Email Headers
Email headers show the path an email took on its way to your email client. Depending on how the email was sent, as well as the email provider used, you may have a chance at locating the original IP address. Email headers contain several IP addresses. Knowing how to interpret email headers takes some practice, but generally the first address in an email header gives you the originating IP address. You can then determine the ISP based on the originating IP address, provided the IP address wasn't masked in some way.
3 Locating Email Headers
Most email clients have an option somewhere within the program to view the original source information. Typically, you can find this by right-clicking the message or the top part of the message, and then selecting an option to view the headers or original source. Each program provides a slightly different method of locating the headers: in Outlook, right-click the message and choose "Message Options"; in Gmail, click the down arrow next to the "Reply" button and select "Show Original"; in Hotmail or Yahoo, right-click the message and choose "View Message Source" or "View Full Headers"; in AOL, select the "Action" button, and then choose "View Message Source."
4 Finding the IP
Because email headers don't always provide you with the originating IP address -- a user who sends an email online from Gmail only provides you with the IP address of the Gmail server, for example -- it's sometimes impossible to locate the original ISP without going through the legal process. However, if that same person uses an email client to send an email through Gmail, the IP address of the computer usually shows up in the headers.
5 Analyzing the IP Address
Once you have an IP address, navigate to one of the free online websites that allow you to track an IP address (links in Resources), paste the IP address into the IP address lookup text field, and then click the "Submit" button to see a list of available information. The ISP usually displays in the ISP section. Most services also indicate whether the IP address comes from a proxy server. However, you can't usually tell when the IP address comes from a VPN. To check, you need to look up the information about the ISP and determine what kind of services they provide.