Where did this email come from?
Drop in a .eml file. FalconEye reads its Received: headers, finds every IP address the message passed through, and shows roughly where each one is.
Or paste raw headers instead
How to get a .eml file:
Gmail: open the email → ⋮ → Download message.
Outlook: open the email → File → Save As, or drag it to your desktop.
Apple Mail: File → Save As → Raw Message Source.
Analysis
Authentication
Findings
Route map
Hop-by-hop route (origin → your inbox)
| # | From | By | IP | Location | Network | Time | Delay |
|---|
Raw headers
What the results can and can't tell you
- Large providers hide the sender. Gmail, Outlook.com, Yahoo and iCloud remove the sender's own IP address. For those emails you'll usually see the provider's data centres, not the person.
- A real origin IP mostly shows up for self-hosted mail servers, some corporate or cPanel setups, and some older email apps.
- Location is approximate. It's usually accurate to the ISP and city or region, never to a street address. VPNs, proxies and mobile data make it less reliable, and mobile IPs often show the carrier's hub city.
- Best use: checking for spoofing and phishing, for example "did this really come from my bank's servers?" It's weak as a way to find where a person is.
- Privacy: your email is parsed on your device. Only the public IP addresses and the sender's domain name are sent to the lookup services (ipwho.is, with ipapi.co and freeipapi.com as backups, and Google Public DNS for reverse DNS and domain records). Attachments are never opened and links are never visited.