Is it possible to know where an email came from? Like where the sender was at the time when they sent it?

[Anonymous]

Is it possible to know who an anonymous reporter is? Like if someone emails YOUR work company anonymously and tries to accuse you of something, can you ever know who they are? Like can you know where the email came from? They did not include an email address, phone number, name... nothing. It was anon. So, could anyone know who did this? Like trace where the message came from (like what computer or a location for the computer location state-wise or city-wise)?

Someone filed a report against me... a false one at that and it almost got me fired. Is there any way to know where the email came from? They emailed, but they didn't leave an email address if that make sense. They spoofed one (it's a fake email in case someone does not know what that means).

So, is there a way to know WHERE the email came from even though it was spoofed and not a real one?

[AviatorTom]

There should be a complete trace of how the email got to you in the email header data. Once you find the IP address of the sender, you can use https://www.iplocation.net/ to find out where the sender was. Be aware though, if it was set anonymously, the sender may have been using a VPN, which will hid their location with a "fake" IP address.

[Asker]

Could they get a VPN after sending the email to protect their identity still?

[Asker]

Like what would happen if the email was already sent via an online form (they filed the report on the form, then in the email section, they put an email in that was not their own), yet they got a VPN after that? Would they be protected from being identified then?

[AviatorTom]

No, they would have to be using the VPN when they sent the mail.

[Asker]

Ok. But if they changed their own IP, could they still deny it wasn't them who sent the email? Do VPNs actually look any different than non-VPN addresses... or do they just let you choose your own location to hide your own? And are emails only connected to the email that is SENT using them at that time? Or do they carry over? Like if you email with one IP, then you have to change it (for whatever reason - got a new router or whatever it may be), would your email you already sent show your new IP or would it still show the old one you originally had?

[AviatorTom]

A user's IP address on the Internet, which is the one in the email) is assigned by their ISP (Internet Service Provider). A new router doesn't change that. The email will always show the IP address when the email was sent. That never changes.

[Asker]

I was asking if they did get a new IP address, would the new one show up to the previously sent email? Or would it still show the old one they used at the time of sending the email?

[AviatorTom]

The email still shows the original OLD IP address. You can't change the contents of an email trace after it's been sent.

[Asker]

Oh, ok. So dang. They could get a new IP and still deny stuff because their OLD IP would be the only evidence linked to the email sent. No way to find out who used to have the old IP, is there?

[DryGermanGuy]

You will find the complete IP trace in the e-Mail header information. The visible endpoint for you will be the internet service provider.

[Asker]

If they get a VPN after sending the email, can you still find out? Or would the VPN cancel that?

[Asker]

Also, how do you find the IP trace in the e-mail header? I've never seen that.

[DryGermanGuy]

You'd have to be in the VPN to leave a different IP path, which means the trace back ends with the VPN service provider.

For the IP information you have to open the email header:

[Asker]

Thank you for showing me that. So looks like the headers show the IPv6, not IPv4. So if they weren't in a VPN... but they did get a new IP, they would still be able to deny it since their OLD IP would show on the header, right?

[Asker]

If they used a VPN, would it be able to be determined just by the header of the email, or would it still look just like a usual IP? If someone was using a proxy to make it harder to detect if it was a VPN or not, could that make someone believe it was just a regular IP?

[DryGermanGuy]

IPs are just that, fairly nondescript addresses. So you have to trace to show where one leads. Your trace will always end at the access point of one certain service provider. And only they can trace from them to the original sender, which they will only do when ordered by a judge.
There is one small giveaway for a VPN, if you run into the same public IP from different emails that means he has a static IP address as a feature, which 99,9999% of regular users don't have. I am not an expert on VPNs though, I assume @AviatorTom can shed more light on that.

[Anonymous]

Yes look in the headers of the e-mail.

[Asker]

What if it wasn't a traditional email-to-email send? Like what if they used an online form to send the report and just put in an email that is not theirs in the email portion (real email address, just not their personal one)?

[Asker]

Will the header of the email trace always contain all the OLD/former info (the IP used at the time along with the MAC and stuff if that is provided)? If they get a NEW IP, they'd still be able to deny stuff, right? Because then THEIR info would not match that in the email header, right?

[Asker]

But as I said before - if they weren't using a VPN and got a NEW IP, well that wouldn't reveal them because the OLD IP would be on the header info and they'd have a freaking new one. So am I right in that case, no evidence could point to them if there was no name trace?

[jahaims]

Yeah

[Asker]

With the IP, you can see where they were at the time, like the city. But if they change that IP address or get a VPN, would they be able to deny it was them? Because wouldn't the OLD IP (original one used) be the one attached to the email header?