exposure of personal IP address via email.

How it was found

hi team When an email is sent, it passes through several email servers (SMTP relays, spam filters, logs, backups).

These servers can store or record everything, including the content of the message (such as your IP address).

Even if the email uses TLS (encryption in transit), the content is decrypted on each server that processes the message.

The IP address can be classified as personally identifiable information (PII) under regulations such as GDPR, and can expose:

Approximate user location

Internet service provider

Hostname that can reveal machine name, organization, or geolocation

Possible correlation with other user activities

Recommendation

Avoid including raw IP addresses in outbound email messages. Instead:

Provide approximate location (city/country) or

Prompt users to log in to a secure dashboard to review login activity.

This ensures adherence to the Principle of Least Privilege, Data Minimization, and Zero Trust security models.

Regulatory Reference:

https://gdpr-info.eu/recitals/no-30/ https://cwe.mitre.org/data/definitions/200.html https://cwe.mitre.org/data/definitions/359.html

Impact

Attackers can leverage the exposed IP for network reconnaissance, which may lead to:

Fingerprinting the user’s device or ISP.

Port scanning, service discovery, or OS detection.

Tracking or correlating with other data leaks (OSINT aggregation).

Targeting with malware campaigns or phishing attacks based on ISP/geolocation.