Extract IP Address From E-mail Header in outlook using VBA

Posted on 2006-06-01
Last Modified: 2008-05-15
Hello All.

I need to try and get the IP Address of the sender of every mail item received using vba.

I have a 'macro' whichs fires each time an e-mail item is received, and I am able to access the full internet header information using 'Outlook redemption'.

However I would like to strip the senders IP address from the header and place it into another e-mail.

The headers are often quite complicated and may contain more then one IP so I am having touble figuring out how to do this.

An example header:

Microsoft Mail Internet Headers Version 2.0
Received: from netpilot.*** ([]) by *** with Microsoft SMTPSVC(6.0.3790.0);
         Thu, 1 Jun 2006 09:44:10 +0100
Received: by netpilot.*** (Postfix, from userid 27)
        id E089923B8F; Thu,  1 Jun 2006 09:46:08 +0100 (BST)
Received: from mail01-*** (unknown [])
        by netpilot.*** (Postfix) with ESMTP id 67BCB23B8E
        for <mike@***>; Thu,  1 Jun 2006 09:46:07 +0100 (BST)
Received: from (unresolved) ([] HELO=smtpout.***.com)
        by mail01-*** (CleanSMTPd 1.5.5) with ESMTP
        id 447F29AF-0 for <mike@***>;
        Thu, 01 Jun 2006 10:46:03 +0200
Received: from [] (helo=***.sbs)
        by smtpout.***.comwith esmtp (Exim 4.30)
        id 1Fliod-0002uX-6k server-id smtp-in2
        for mike@***; Thu, 01 Jun 2006 09:46:03 +0100
Subject: test
MIME-Version: 1.0
Content-Type: multipart/alternative;
Date: Thu, 1 Jun 2006 09:37:46 +0100
Message-ID: <>
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
content-class: urn:content-classes:message
Thread-Topic: test
Thread-Index: AcaFVZz9x8Llg/FPEdqSOwBQ2jyEkA==
From: "***" <***@***>
To: <mike@***>
X-Email-Filter-2B-F6-5F: 3.1.5 netpilot.***
X-Spam-Checker-Version-2B-F6-5F: SpamAssassin 2.64 (2004-01-11) on
X-Spam-Flag-2B-F6-5F: NO
X-Spam-Status-2B-F6-5F: hits=-4.7 tests=BAYES_00,HTML_70_80,HTML_MESSAGE autolearn=no
X-Spam-Key-2B-F6-5F: (-4.7 points in total)
X-Spam-Key-2B-F6-5F: -4.9 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                            [score: 0.0000]
X-Spam-Key-2B-F6-5F: 0.1 HTML_70_80             BODY: Message is 70% to 80% HTML
X-Spam-Key-2B-F6-5F: 0.1 HTML_MESSAGE           BODY: HTML included in message
X-Spam-Reclassify-2B-F6-5F: https://netpilot.***

X-Virus-Checked-2B-F6-5F: 0 Anti-virus engine 4.02.0, released 06 February 2006, 119637 virus identities.
Return-Path: ***@***.org
X-OriginalArrivalTime: 01 Jun 2006 08:44:10.0576 (UTC) FILETIME=[8D4A8D00:01C68557]

Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable

Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable


Question by:MikeSel
    LVL 35

    Expert Comment

    by:[ fanpages ]
    Retrieving an IP address that is prefixed with "192.168." is probably not going to be much use anyway (unless you are inside the sender's network).
    LVL 4

    Author Comment

    Sorry I removed the 'Real' IP addresses and replaced them with 192's to protect the senders details etc
    LVL 35

    Accepted Solution

    Hi Mike,

    Which IP are you looking for? All of them?

    Heres a function which returns an array of addresses found in the header using regular expressions:

    Function GetIPAddresses(ByVal MsgHeader As String) As String()
     Dim tempArr() As String, i As Long, RegEx As Object, RegC As Object
     Set RegEx = CreateObject("vbscript.regexp")
     ReDim tempArr(0)
     With RegEx
      .Global = True
      .MultiLine = True
      .Pattern = "\[?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\]?"
     End With
     If RegEx.Test(MsgHeader) Then
      Set RegC = RegEx.Execute(MsgHeader)
      ReDim tempArr(RegC.Count - 1)
      For i = 0 To RegC.Count - 1
       tempArr(i) = RegC.Item(i).SubMatches(0)
     End If
     Set RegEx = Nothing
     Set RegC = Nothing
     GetIPAddresses = tempArr
    End Function

    Sample usage:
     Dim IPAddrs() As String
     IPAddrs = GetIPAddresses(theHeader)
     If Len(IPAddrs(0)) > 0 Then
      MsgBox Join(IPAddrs, vbCrLf)
     End If

    If there is a way to determine which one address you want based on some part of the header, let me know and I can update the pattern.  Please let me know if there is anything else!

    LVL 4

    Author Comment

    Works a treat!!

    Thanks for all your help!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Better Security Awareness With Threat Intelligence

    See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

    I’ve seen a number of people looking for examples of how to access web services from VB6.  I’ve been using a test harness I built in VB6 (using many resources I found online) that I use for small projects to work out how to communicate with web serv…
    Background What I'm presenting in this article is the result of 2 conditions in my work area: We have a SQL Server production environment but no development or test environment; andWe have an MS Access front end using tables in SQL Server but we a…
    Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
    Get people started with the utilization of class modules. Class modules can be a powerful tool in Microsoft Access. They allow you to create self-contained objects that encapsulate functionality. They can easily hide the complexity of a process from…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now