You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases.
The email header of the suspicious email is given below:
A potentially malicious email has bypassed perimeter spam filters. The analyst is performing email header analysis to trace the routing hops (Mail Transfer Agents) backwards to discover the true source IP address of the threat actor. This allows the defense team to gather geolocation and WHOIS intelligence on the attacker.
This is a classic spoofing/phishing attempt. The attacker is sending an email claiming to be "IT Support," but the routing path reveals it originated from an untrusted, dynamic external IP address rather than the internal corporate network.
D. 216.168.54.25 is correct. When analyzing SMTP email headers, the "Received:" lines document the email's journey. These lines are appended at the top as the email traverses MTAs. To trace to the origin, you read from bottom to top. The lowest "Received:" line in the block shows the first interaction between the sender's mail client and the first internet MTA. Additionally, the `X-Originating-IP` header explicitly confirms this IP.
A. 209.191.91.180: This is an intermediate MTA relay (mta-relay.isp.com). It forwarded the email, but did not originate it.
B. 141.1.1.1: This is likely the organization's perimeter edge filter (edge-filter.corp.net). It received the mail from the internet and passed it internally.
C. 172.16.10.90: This is an internal, private IP address (RFC 1918) belonging to the internal mail server. It is the last hop before delivery to the user's inbox.
Add 216.168.54.25 to the external firewall drop list to prevent further connection attempts from this attacker. Additionally, update the corporate email gateway (Secure Email Gateway / SEG) to quarantine any incoming emails associated with the "suspicious-domain.com" domain or this originating IP.
10.x.x.x, 172.16.x.x to 172.31.x.x, and 192.168.x.x are internal. They will appear at the top of the chain (closest to the user), not at the bottom where the external attacker is located.Master network traffic analysis, perimeter security, and threat detection.
Explore more CND simulations