Question

Forensics involves the investigation and documentation of a given crime to provide evidence that is typically used for legal action. E-mail is extensively used in personal and business operations to communicate with individuals in a fast and cost-effective manner. However, more frequently than not, email is used as a platform for fraud, deceit, crime, identity theft, or even information phishing.

What are some examples of e-mail scams (e.g., Nigerian scams, false credit or account alerts, dating scams, etc.)?

1. What is the purpose of such an e-mail attack?

2. What is the relevance of IP addresses in e-mail forensics?

3.What challenges arise when attempting to identify the source of a given e-mail message?

Answer 1

Email fraud which is made for personal gain or to damage another individual through email, used as a means to defraud people. Email fraud can take the form of a scam. Some examples of e-mail scams are as follows :

Help Desk National Microsoft Pinpoint scammers

"TradeMe" Scammer

Free kitten from Thailand scam

Flatmate scammer

Malware notification via Facebook

Online Dating scammer

Scammer on Autotrader

Parrot (and other animals) scammer and many others.

1.

Email is a most common tool used to communicate in the society in a formal or informal way. The purpose of such an e-mail attack may often used to steal user data, including login credentials and credit card numbers. An attack can have many bad results. For individuals, this includes unauthorized purchases, the stealing of funds, or identify theft.

The users are allowed to enter there details in apage that looks similar to the original one but is a fraud page. Which results in masquerading. And the data they enter is used by a hacker to steal the details he wanted and does harm by those details.

2.

the relevance of IP addresses in e-mail forensics is that The hacker may change the IP address accordin to the need so in some cases it becomes difficult to catch the exact location of the person who is trying to hack the system. Internet Protocol Address (IP Address) is the starting point for not only initiating communications across the Internet but also to trace back the same to a particular Computer System. An IP Address is not always as it seems to be and there may be instances of IP Address Spoofing where the IP Address is forged to mislead and results in tracking the erson position. This is also the reason why an IP Address should not be the exclusive criteria to arrest and convict an accused. More often The details of IP Address can be found in Log Files, in the Received Header fields of an E-Mail, by Pinging or doing a Whois Query of a Website, etc. Once the IP Address has been ascertained, it is important to Track who is using the concerned IP address.

3.

With Static IP Addresses the problem of Tracking a person is comparatively easy. However, Dynamic IP Addresses keep on changing with every use.

E-Mails generate “Received Headers” as they travel from different host and so by reading them in order, we can reconstruct the original source of the E-Mail. However, reading E-Mail Header fields to ascertain true IP Address of the sender requires good working knowledge in this regard.

When relaying a message from another relay host, current versions of SMTP also keep track of the IP address of the system connecting to them, and they add that IP address to the header of the message. If you want to show that a mail message originated from a specific computer, the best way to do so is to investigate the entire path that appears in the extended header information.