ExamRange
Home ExamRange Practice Tests
Welcome to this CND practice simulation. Here you will evaluate raw email headers to identify the true origin of a suspicious communication. Tracing routing paths and understanding SMTP behavior is essential for identifying spoofed emails and blocking threat actors at the network perimeter.

CND (312-38) Network Defense Simulation

Network Scenario

You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases.

Traffic & Logs

The email header of the suspicious email is given below:

Delivered-To: analyst@corp.net Received: by 10.12.34.56 with SMTP id aa12345; Wed, 22 Nov 2023 09:15:30 -0800 (PST) Received: from internal-mail.corp.local (172.16.10.90) by exchange.corp.local with Microsoft SMTP Server; Wed, 22 Nov 2023 09:15:28 -0800 Received: from edge-filter.corp.net (141.1.1.1) by internal-mail.corp.local with ESMTP id 987654321; Wed, 22 Nov 2023 09:15:26 -0800 Received: from mta-relay.isp.com (209.191.91.180) by edge-filter.corp.net with ESMTP id AABBCCDDEE; Wed, 22 Nov 2023 09:15:21 -0800 Received: from unknown-client (dynamic-216-168-54-25.rogue-isp.net [216.168.54.25]) by mta-relay.isp.com with SMTP id xyz123; Wed, 22 Nov 2023 09:15:10 -0800 X-Originating-IP: [216.168.54.25] From: "IT Support" <admin-update@suspicious-domain.com> To: target.user@corp.net Subject: URGENT: Password Expiry Notification Date: Wed, 22 Nov 2023 09:15:05 -0800 Message-ID: <1234567890@suspicious-domain.com>

Question

What is the IP address of the sender of this email?
Hint: Email headers are read chronologically from bottom to top. The first 'Received:' block at the bottom, or an 'X-Originating-IP' field, usually indicates the initial point of transmission from the sender's client to the first Mail Transfer Agent (MTA).

Expert Analysis

1. What is happening in the network

A potentially malicious email has bypassed perimeter spam filters. The analyst is performing email header analysis to trace the routing hops (Mail Transfer Agents) backwards to discover the true source IP address of the threat actor. This allows the defense team to gather geolocation and WHOIS intelligence on the attacker.

2. Identify attack or behavior

This is a classic spoofing/phishing attempt. The attacker is sending an email claiming to be "IT Support," but the routing path reveals it originated from an untrusted, dynamic external IP address rather than the internal corporate network.

3. Why the correct answer is correct

D. 216.168.54.25 is correct. When analyzing SMTP email headers, the "Received:" lines document the email's journey. These lines are appended at the top as the email traverses MTAs. To trace to the origin, you read from bottom to top. The lowest "Received:" line in the block shows the first interaction between the sender's mail client and the first internet MTA. Additionally, the `X-Originating-IP` header explicitly confirms this IP.

4. Why others are wrong

A. 209.191.91.180: This is an intermediate MTA relay (mta-relay.isp.com). It forwarded the email, but did not originate it.
B. 141.1.1.1: This is likely the organization's perimeter edge filter (edge-filter.corp.net). It received the mail from the internet and passed it internally.
C. 172.16.10.90: This is an internal, private IP address (RFC 1918) belonging to the internal mail server. It is the last hop before delivery to the user's inbox.

5. Defensive action

Add 216.168.54.25 to the external firewall drop list to prevent further connection attempts from this attacker. Additionally, update the corporate email gateway (Secure Email Gateway / SEG) to quarantine any incoming emails associated with the "suspicious-domain.com" domain or this originating IP.

MINI LESSON: Email Header Forensics

  • Chronological Order: Always read `Received:` headers from bottom to top to trace an email from sender to receiver.
  • RFC 1918 Recognition: Understand that IPs like 10.x.x.x, 172.16.x.x to 172.31.x.x, and 192.168.x.x are internal. They will appear at the top of the chain (closest to the user), not at the bottom where the external attacker is located.
  • X-Headers: Headers starting with `X-` are non-standard but highly useful. `X-Originating-IP` or `X-Sender-IP` are frequently added by the first SMTP server to permanently record the client's public IP address, preventing them from hiding behind a compromised mail server.

Ready to test more Network Defense concepts?

Master network traffic analysis, perimeter security, and threat detection.

Explore more CND simulations