Tracking where an email came from

We received a suspicious email from someone with a gmail address. Looking at the headers we ascertained the email came from:

Received: from mail-vc0-f179.google.com
(mail-vc0-f179.google.com [209.85.220.179])

There is no DNS LOC record for this host and UnDNS (part of RocketFuel) cannot find it.

SatSig (http://www.satsig.net/maps/lat-long-finder.htm)  identifies the host as being near Ankara, Turkey.

GeoIPTools (http://www.geoiptool.com/en/?ip=209.85.220.179), IPLocation (http://www.iplocation.net/click/1), IPLigence (http://www.iplocation.net/click/2), IPFinger (http://www.ipfingerprints.com/) and GeoPlugin (http://www.geoplugin.com/) identify it at  Mountain View California (home of Google HQ).

Using TULIP we find it is probably located in S. Carolina near Manning. The nearest Google data center is 17 in the map below. It is located at Goose Creek S. Carolina.. The distance between the Manning and Goose Creek is 49.3 miles as the crow flies.

TULIP estimate (orange balloon)of the location of the gmail server, near Manning S. CarolinaLocation of Google data centers, note 17 at Goose Creek S. CarolinaMap showing Tulip estimate (orange balloon tip at top) & Goose Creek at the bottomDriving map from Manning to Goose Creek

 

 

 

 

 

 

 

 

  • No labels