tracking e mail from exchange 2003

the best way to get this information is to right click on the message and select options to get the message header information

And once you have the source IP address of the sending mail server, you can look up its location with www.ip2location.com.

I looked at the Message Tracking center and I saw for this sender<

Message id> SNT114-W457259A99CCD1158DE0F5BD1BD0@phx.gbl what does it mean?

If you open up the email and post the header information we can advise you where it came from etc.

Outlook 2000 / 2002 / 2003

http://office.microsoft.com/en-us/outlook/HA010937071033.aspx

Outlook 2007

http://office.microsoft.com/en-us/outlook/HA012303001033.aspx

You can check the host header information bit it has probably come from hotmail?
You can report abuse to the hotmail team: http://windowslivehelp.com/solutions/safety/archive/2009/03/23/how-to-report-abuse-or-spam-in-windows-live-hotmail.aspx

It's unlikely you are going to be able to track exactly who sent it.

Message-ID: <SNT114-W457259A99CCD1158DE0F5BD1BD0@phx.gbl>
Content-Type: multipart/mixed;
boundary="_09038b29-0d98-4f76-8f0b-06aa904d655a_"
X-Originating-IP: [78.181.0.248]
From: k k <kkbshg@hotmail.com>

Can you please post the entire header info, not just part of it.

Whois shows that IP address is owned by turktelekom.com.tr
Which I am guessing is a turkish ADSL provider?

It is also on 4 blacklist sites

Hmm, an open relay me thinks! Or some trojan that is mass mailing from spurious e-mail addresses!
I cannot telnet to it so it's not online.

yes it's true..I think it's aturkish adsl provider..can We find the location?

only if you phone them and ask them who own's that IP address.

I guess this begs the question about your anti-spam software and if you are using some, how effective it is.

I have recently trialled Vamsoft ORF and found it to be extremely effective and it only costs $239 per server.

The download is only 4Mb and it is easy to setup and configure.  Since switching several customers, they have all reported a massive drop in the level of spam they receive.  One I spoke to not 10 minutes ago has said that they have not received any spam at all in their 30 days of trial.  I will be buying them a license tomorrow.

www.vamsoft.com - sorry - forgot to include the link.

you should sign up for royalties ;-)

Working on it!

Message-ID: <SNT114-W457259A99CCD1158DE0F5BD1BD0@phx.gbl>
Content-Type: multipart/mixed;
boundary="_09038b29-0d98-4f76-8f0b-06aa904d655a_"
X-Originating-IP: [78.181.0.248]
From: k k <kkbshg@hotmail.com>
To: <damla.altintas@bshg.com>
Subject:
Date: Fri, 23 Oct 2009 23:23:47 +0300
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 23 Oct 2009 20:23:47.0714 (UTC) FILETIME=[B9D77E20:01CA541E]
X-RMX-ID: 20091023-222350-n9NKNlwp006830-0@mailin13
X-RMX-TRACE: 2009-10-23 22:23:54 RmxMetaAS@mailin13/mailcc02 [1.8s] 20091023-222350-n9NKNlwp006830-0@mailin13 0:00:04
X-RMX-TRACE: 2009-10-23 22:23:52 RmxMSI@mailin13/mailcc08 [0.2s] 20091023-222350-n9NKNlwp006830-0@mailin13 0:00:02
X-RMX-TRACE: 2009-10-23 22:23:51 RmxDf@mailin13/mailcc01 [1.1s] 20091023-222350-n9NKNlwp006830-0@mailin13 0:00:01
X-RMX-RQ: 100
X-RMX-RC: 26
X-BSHG: 1.1
X-BSHG-Version2: 5.5.8.383112, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2009.10.23.201535
X-RMX-Spam: Gauge=IIIIII, Probability=6%, Report='
RMX_RQ_100+ -0.7, HTML_70_90! 0.25, BAYES_40_49! 0, FORGED_FROM_HOTMAIL 0.1, BODY_SIZE_10000_PLUS 0, TO_NO_NAME 0, WEBMAIL_SOURCE 0, WEBMAIL_XOIP 0, WEBMAIL_X_IP_HDR 0, __CP_URI_IN_BODY 0, __CT 0, __CTYPE_HAS_BOUNDARY 0, __CTYPE_MULTIPART 0, __CTYPE_MULTIPART_MIXED 0, __DATE_TZ_RU 0, __FRAUD_419_WEBMAIL 0, __FRAUD_419_WEBMAIL_FROM 0, __FROM_HOTMAIL 0, __HAS_HTML 0, __HAS_MSGID 0, __HAS_XOAT 0, __HAS_XOIP 0, __MIME_HTML 0, __MIME_VERSION 0, __RECEIVED_FROM_MSN_LIVE 0, __SANE_MSGID 0, __STYLE_RATWARE_2 0, __TAG_EXISTS_BODY 0, __TAG_EXISTS_HEAD 0, __TAG_EXISTS_HTML 0, __TO_MALFORMED_2 0, __URI_NS , __bl.spamcop.net_ERROR , __dnsbl.njabl.org_ERROR , __dnsbl.sorbs.net_ERROR , __ix.dnsbl.manitu.net_ERROR , __sbl.spamhaus.org_ERROR , __virbl.dnsbl.bit.nl_ERROR '
Return-Path: kkbshg@hotmail.com   --_09038b29-0d98-4f76-8f0b-06aa904d655a_
Content-Type: multipart/alternative;
boundary="_fc7f1969-4c2a-4536-8f87-571a04055501_"   --_fc7f1969-4c2a-4536-8f87-571a04055501_
Content-Type: text/plain; charset="windows-1254"
Content-Transfer-Encoding: 8bit   --_fc7f1969-4c2a-4536-8f87-571a04055501_
Content-Type: text/html; charset="windows-1254"
Content-Transfer-Encoding: 8bit  
--_fc7f1969-4c2a-4536-8f87-571a04055501_--
--_09038b29-0d98-4f76-8f0b-06aa904d655a_
Content-Type: application/msword
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="bendekisen.doc"  
--_09038b29-0d98-4f76-8f0b-06aa904d655a_--

Those headers seem to be quite modified and my tools to analzye are failing.

Either way - the IP is blacklisted several times and the message is quite clearly spam.

what does it mean  that ip adress is blacklisted?

as we use the same tools I won't try ;-)

The atatchment bendekisen.doc, what was it?

This is the only line of interest:

X-Originating-IP: [78.181.0.248]

That shows where the message originated.

However most ISPs will not hand out IP address information without a court order.

Simon.

What do you mean - you didn't get an answer to your question?  What more information do you want?