Public Database:
Public databases constantly have holes in the way thier system is set up, allowing private record access with little or no work. I have been able to get alot of information on someone (A freind) from private records being put in public record databases by mistake as well. Information in public records is one way to gather information for a social engineering attack.
This site contains a list of public records.
http://www.searchsystems.net/
Detecting simple spoofed headers and gaining the Ip of the e-mailer:
Received: (qmail 25587 invoked from network); 10 Dec 2003 01:51:10 -0000
Received: from unknown (HELO xxx.xxx.com) (xx.xx.xxx.xx) by xxx.xxx.xxx with SMTP; 10 Dec 2003 01:51:10 -0000
Received: (qmail 32157 invoked from network); 10 Dec 2003 01:51:06 -0000
Received: from unknown (HELO xxxx) ([xx.xx.xx]) (envelope-sender <xxx@xxx.xx>) by xxx.xxx.x.xx (qmail-ldap-1.03) with SMTP for <xxx@xxx.xx>; 10 Dec 2003 01:51:06 -0000
Make sure that the (envelope-sender <xxx@xxx.xx>) matches with the e-mail address that is in the from portion.
Received: from unknown (HELO xxxx) ([xxx.xxx.xxx]) (envelope-sender <xxx@xxx.xx>) by xxx.xxx.x.xx (qmail-ldap-1.03) with SMTP for <xxx@xxx.xx>; 10 Dec 2003 01:51:06 -0000
Also make sure the portion @xxx.xx matches with the "(HELO xxx.xxx.com)" from the below portion. Basically making sure it came from that network.
Received: from unknown (HELO xxx.xxx.com) (xx.xx.xxx.xx) by xxx.xxx.xxx with SMTP; 10 Dec 2003 01:51:10 -0000
The Ip of the person who e-mailed can be obtained from the X- Originating ip header. Some mail programs don't have that header though. In that case you can get it from the last recieve " (xx.xx.xxx.xx) by ".
Received: from unknown (HELO xxx.xxx.com) (xx.xx.xxx.xx) by xxx.xxx.xxx with SMTP; 10 Dec 2003 01:51:10 -0000
If these headers are present they make things easier
X-Originating-Email: [xxx@xxx.com]
X-Sender: xxx@xxx.com
Look if they match with
From: "xxxxx" <xxx@xx.com>