Email Forensics & Phishing Investigation

Email Header & Hop Trace Analyzer

Paste raw email headers from Gmail, Outlook, or Apple Mail to uncover originating sender server IPs, analyze relay hop delay latency, and verify SPF/DKIM authentication.

Email Header & Hop Trace Analyzer

RFC 822 / 5322

Inspect email headers, extract originating sender server IPs, analyze mail relay hop latency, and detect phishing indicators.

Upload .eml / .txt

Raw RFC 822 Email Headers:1868 chars

Received-SPF: pass (google.com: domain of support@legit-service.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
From: "Customer Support" <support@legit-service.com>
Reply-To: support@legit-service.com
To: victim-recipient@company.com
Subject: Your Security Verification Pin
Date: Tue, 18 Aug 2026 21:22:10 +0000
Message-ID: <CABc=1234567890abcdef@mail.legit-service.com>
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"

Web Server / Host IP209.85.220.41

Outbound Sender SMTP209.85.220.41

Mailer / Script EngineStandard MTA

SPF / DMARC Auth

PASS/PASS

From:"Customer Support" <support@legit-service.com>

Return-Path:<support@legit-service.com>

Subject:Your Security Verification Pin

Relay Hop Path (2 Hops Recorded)

Hop #1mail-sor-f41.google.com → mx.google.com

IP: 209.85.220.41★ Public Sender IPProto: SMTPS

Hop #2Unknown Host → 2002:a05:6512:214:b0:53e:8912:3456

Proto: SMTP

+2s Delay

100% Client-Side Parse: Email contents remain private in browserSecureStack Email Recon

Originating IP Extraction

Isolates the earliest public MTA mail server IP address responsible for injecting the email into the internet.

Spoofing & Mismatch Detection

Detects discrepancy between user-facing `From:` display headers and underlying `Return-Path` envelope domains.

Hop Latency Timeline

Calculates delivery seconds between relay intermediaries to identify suspicious forwarding delays or proxy interception.